Privacy policy

What we process

Member sign-in: Google account identifier and email address.

Member profile: name, photo, affiliation, introduction, experience and education, links, interests, cohort and role, research teams and publications.

Staying signed in: a cookie that identifies your sign-in session.

Recruiting notice: the email address and language given when signing up for it.

Error records: when the website, the admin screens or the API hit an error, the error details and where it occurred, the page or API address (without parameters after the address), browser and device information, and an approximate location (country and city) estimated from the IP address.

Why

To identify members and sign them in, to publish the profiles members choose to make public, and to present OUTTA's activities and research. Error records are used only to find and fix service errors. An email address signed up for the recruiting notice is used only to send that notice when recruiting opens.

What is public

A profile appears on the website only if the member chooses to make it public. Email addresses and Google account identifiers are never shown.

Processors

Amazon Web Services: hosting the website and storing and serving profile photos.

Cloudflare: storing member data and running the API.

Anthropic: automatic Korean–English translation of profiles. Only the profile text to be translated is sent.

Google: sign-in authentication.

Sentry: error monitoring for the website, the admin screens and the API.

Transfers outside Korea

Anthropic, PBC (USA, Claude API): when a member or organizer saves a profile, the bio, experience, affiliation, tagline and role text are sent for Korean–English translation. The transfer happens over the network at save time; OUTTA does not ask Anthropic to keep the text after the translation is returned.

Cloudflare, Inc. (USA and data centers worldwide): to run the API and the member database (D1), stores and processes all member data; the email addresses and languages signed up for the recruiting notice; the notice delivery records; and values derived from those addresses that cannot be read back, which keep a cohort's notice from being sent twice. Each is kept for the period under “Retention”.

Amazon Web Services, Inc. (S3 and CloudFront; Seoul region and global delivery network): stores and delivers profile photos and the public website.

ORCID (pub.orcid.org), arXiv (arxiv.org) and OpenAlex (api.openalex.org) (USA and elsewhere): only the public ORCID iD you enter is sent, to look up public publication records. No name, email or other data is sent.

Google LLC (USA, OAuth sign-in): exchanges your email address, name and Google account identifier to verify sign-in.

Functional Software, Inc. (USA, Sentry): to find and fix service errors, when the website, the admin screens or the API hit an error, receives the error details and where it occurred, the page or API address (without parameters after the address) and browser and device information, plus timing records for a sample of requests. Sentry estimates an approximate location (country and city) from the connecting IP address and keeps it with the report, but does not keep a visitor's IP address itself. It is set up not to receive cookies, request bodies (what you type), screen recordings or the names of clicked elements. Errors on signed-in member pages, such as My page, are reported the same way, without account details. Sentry keeps error records for 90 days and request timings for 30 days.

If you don't want your data transferred abroad, you can hide your profile or ask contact@outta.ai to delete it; you then can't sign in or save a profile.

Optional analytics and marketing tools

The tools below run only if you agree to that category in “Visitor data settings”. Nothing is sent to these providers before you agree, and the settings show which tools are actually connected. Pages that show a signed-in member's own data (such as My page) never load these tools, whatever you choose. Sending data to Google and Microsoft is a transfer outside Korea; it happens over the network each time you use a page after agreeing.

Google LLC (USA, Google Analytics and Google Tag Manager): with analytics consent, to understand how the site is used, receives the page address (without parameters such as search filters), page title, referrer, usage events such as clicks on the application button and outbound links and scrolling, device and browser information, IP address and a cookie identifier. With marketing consent, the same data is also used to measure advertising performance. Google Analytics keeps this data for 14 months.

Microsoft Corporation (USA, Microsoft Clarity): with analytics consent, to improve the site, receives the pages visited, a replayable record of on-page interactions such as clicks, scrolling and mouse movement (session recording), device and browser information, IP address and a cookie identifier. This data is not shared with Microsoft's advertising. Input fields, drop-down lists, and numbers and email addresses shown on the page are masked in recordings. Recordings are kept for 30 days; favorited recordings and a random sample are kept for up to 9 months. Click data used for heatmaps and other reports (such as page URLs, a user identifier and pointer distance) is kept for 9 months.

NAVER Corp. (Korea, Naver Analytics): with analytics consent, to count visits, receives the pages visited, referrer, device and browser information, IP address and a cookie identifier. NAVER keeps the analysis data, with no set end date, for as long as OUTTA uses Naver Analytics, and doesn't give it to third parties without OUTTA's consent. Its visitor cookie stays in the browser until you delete it.

Kakao Corp. (Korea, Kakao Pixel): with marketing consent, to measure advertising performance, receives the pages visited, clicks on the application button, device and browser information, IP address, and cookie and advertising identifiers. Its advertising cookie stays in the browser for up to a year.

Your choice is stored only in this browser. You can withdraw consent at any time from “Visitor data settings” at the bottom of the page; the page then reloads and those tools are no longer loaded. Data already sent and cookies already stored are not deleted automatically; you can delete cookies in your browser settings. How long Kakao keeps the data on its servers follows Kakao's privacy policy.

Retention

Member data is kept while membership lasts and deleted without delay on request. Sign-in sessions last at most 30 days. An email address and language signed up for the recruiting notice are kept for 3 years from sign-up and then deleted. When the notice is sent, a delivery record (email address, language and result) is kept for 3 years from sending, and a value derived from the email address that cannot be read back is kept for up to 1 year so the same cohort's notice isn't sent twice. To have any of these deleted sooner, contact us below.

Your rights

Members can view, edit or hide their profile on My page at any time. For any other request to access, correct, delete or stop processing your data, contact us below.

Privacy officer

OUTTA organizers · contact@outta.ai