Controller and privacy officer
Hylē is provided by REFRESH Co., Ltd., a company in the Republic of Korea. Our representative and CEO is Junhoo Choi. Contact us at hyle@refresh.ai.kr.
Our privacy officer is Junhoo Choi. Send privacy or data-rights requests to hyle@refresh.ai.kr. This policy takes effect on 8 October 2026.
Information we collect
We collect your account email and ID, research questions, files you choose to upload (PDF, text, or CSV), projects, outputs, citations, and run records needed for the requested service. We record the versions of the terms, privacy, and refund consents you accept and your processing choices.
Hosting services process connection and request information needed to deliver and secure the service. Purchases, once available, create billing and transaction records. A support email includes the address and information you send. The contact page opens your email app; it does not itself store or send the inquiry.
Purposes and legal bases
We process essential account and workflow information to enter into and perform our service contract: authenticating you, running your requested analysis, saving your workspace, and replying to support requests. Transaction retention is based on legal obligations. Necessary security processing protects accounts and the service within applicable law.
We obtain processing consent at sign-up and make it available to review and adjust in Settings. Where separate consent is required for overseas AI processing or another transfer, we obtain it before that processing. Contract necessity is not a blanket permission for a provider to train on your personal information. Refusing or withdrawing required processing consent can make the affected workflow unavailable.
Providers and international transfers
Running a requested workflow can transfer its necessary inputs outside Korea through provider APIs and infrastructure. The table identifies the confirmed recipients, locations, data categories, purposes, and retention limits. Transfers occur electronically when the relevant service is used. Some payment providers act as independent controllers for their transaction obligations.
| Provider / location | Information | Purpose and timing | Retention boundary |
|---|---|---|---|
| Supabase Pte. Ltd. · Singapore; staging Frankfurt, Germany; production database region Seoul, Korea | Account email and ID, consent records, projects, and workspace records. | Authentication, database, and storage when you register or use a workspace. Support processing may involve Singapore or the United States. | Our workspace/account schedule below; backups expire after deletion. Production activation is separate from the selected region. |
| Vercel · United States · US-East (iad1) | Page requests, connection information, and information needed by web functions. | Web hosting and request handling while you visit or use Hylē. | Provider plan-dependent logs; no fixed log retention period has been verified. |
| Hetzner Online GmbH · Falkenstein, Germany | Uploaded research files, necessary inputs, results, and run records. | Private file storage and research computation during requested workflows. | Our deletion and backup schedule below. |
| Hangzhou DeepSeek Artificial Intelligence Co., Ltd. · China | Questions and the excerpts or data needed for generation; this can include unpublished material. | AI generation during a run, transmitted through its API; data is collected, processed, and stored in China. | DeepSeek states retention for as long as necessary, without a fixed period. No guarantee excludes API inputs from training. |
| OpenAlex, Crossref, Europe PMC, Unpaywall, arXiv, and NCBI / PubMed · external literature services | Reduced search queries, DOIs, or literature identifiers; no customer account details or full uploaded files. | Finding and checking supporting literature during a run. Some APIs receive Hylē’s service contact email, not your email. | Hylē does not store web-search results. Each literature provider has its own processing locations and retention policy. |
| Resend · external email delivery service | Recipient email and the service email content. | Sending account and service messages when needed; no marketing tracking. | The source facts do not verify its processing regions or a fixed provider retention period; review the email provider’s privacy notice before activation. |
| Toss Payments · Korea; PayPal and Lemon Squeezy · international payment services | Billing and transaction information needed for payment, invoices, refunds, and disputes. | When a payment flow is activated and you make a purchase. Lemon Squeezy is merchant of record after approval; PayPal may be a payment option. | Hylē’s statutory transaction schedule below. International providers’ processing regions and separate retention are disclosed in their payment/privacy notices at checkout. |
You may ask our privacy officer about a transfer, request access or deletion, or withdraw applicable consent in Settings or by email. We do not claim a signed DPA, a specific transfer certification, or a provider retention promise that we have not verified.
DeepSeek and unpublished research
DeepSeek generates the service’s AI text. Requested questions and necessary excerpts or data may be processed and stored in China. DeepSeek’s published policy does not provide a fixed API retention period or a guarantee that API inputs are excluded from its model training. Hylē does not train on uploads, but cannot extend that promise to DeepSeek’s own processing.
If you mark material “unpublished” in Settings or the upload controls, manuscript content is removed from external literature and web-search queries. This option does not prevent DeepSeek processing and does not make processing local-only. Do not submit material your rights or confidentiality obligations prevent you from sending to this provider.
Private uploads and literature searches
Uploads and their structured claim graphs stay private and owner-scoped. They are deletable and are never added to our shared public cache or used by Hylē for model training. Sharing a project with authorized group members is controlled by your permissions.
Literature services receive reduced queries, DOIs, and literature identifiers, not customer account details or full uploads. Semantic Scholar is blocked in the documented transport. Public shared full-text caching is limited to CC BY, CC0, and public-domain papers with license evidence, source attribution, and dates.
Retention and deletion
| Record | Retention / deletion |
|---|---|
| Account email and ID, consent records, research questions, uploads, projects, results, and run records | Kept while needed to provide your account and requested workspace. You may delete uploads and projects. On account-deletion request, account and research records are removed from active systems within 30 days, except required legal records. |
| Backups | 48 half-hourly copies, 14 daily copies, and database dumps retained for 7 days. Deleted data can remain in backups for up to 14 days after removal from active systems; account deletion can therefore take up to 30 days in active systems plus backup expiry. |
| Contracts, withdrawal/cancellation, payment, and supply records | 5 years, as required by the Korean E-Commerce Act and its Enforcement Decree. |
| Customer complaints and disputes | 3 years under the Korean E-Commerce Act and its Enforcement Decree. |
| External provider copies and logs | Providers apply their own retention rules as explained above. Hylē’s deletion schedule does not guarantee deletion from DeepSeek or other independent provider systems. |
Required legal records are retained only for their legal purpose. We delete or anonymize information when its permitted retention ends. Backups are not a continuing workspace and expire through the rotation above.
Security
We restrict research records to their owner or authorized project members and use access controls and HTTPS for service connections. We limit the information sent to literature APIs and separate private uploads from shared public literature. These measures reduce risk; no service can guarantee perfect security.
We do not claim that every provider copy is encrypted at rest, that Hylē has an independent security certification, or that external-provider deletion has been verified. Contact the privacy officer to report a suspected data-security issue.
Your rights and requests
You may request access, correction, deletion, restriction or suspension of processing, and withdrawal of consent, subject to applicable law. Review your consent and unpublished choices in Settings, delete available uploads or projects in the app, or email hyle@refresh.ai.kr for help, export, or account deletion.
We reply to rights requests within 10 days. We may verify your identity using your signed-in account or registered email, and explain any legal reason that prevents a requested deletion or restriction. Consent withdrawal does not undo processing already carried out lawfully; required processing may affect continued service.
Children and sensitive information
Hylē does not allow sign-ups by children under 14. Contact us if an under-14 child has provided information so we can address deletion. Do not upload patient-identifying health records, identifiable genomic data, or other sensitive personal information without a separately agreed and lawful processing arrangement.
Cookies and the public demo
We use essential cookies or local storage for authentication, security, and service preferences. We use no marketing trackers. Browser controls can remove or block storage, although sign-in or essential features may then stop working.
The public demo uses example data and makes no model-provider or literature-API call. Its hosting still handles the page request. The actual app workflow and the inputs you choose to submit have the provider boundaries described above.
Changes to this policy
We publish policy changes here with a new effective date and notify you in the app or by email before a material change. If a change requires new consent, we obtain it before the affected processing.