Privacy Policy

This English translation is provided for convenience. If there is any difference between this translation and the Korean version, the Korean version prevails.

Operator: Youngrae Cho (조영래) · Target country: Republic of Korea · Policy version: 2026-09-26.2 · Effective date: 2026-09-26

Privacy contact: privacy@vitawrite.com

Last updated: 2026-09-26

VitaWrite is operated by Youngrae Cho (조영래) and is provided to users in the Republic of Korea. Please send requests to access, correct or delete personal information, and any questions about how it is processed, to privacy@vitawrite.com.

Writing without an account: resume content, document names and photos are stored in the browser's IndexedDB. Deleting a device document or clearing site data removes it from that device. Backup files are plain-text files that contain personal information, and users keep and delete them themselves. Keep any backups you need before clearing browser data.

Account storage: your email address, authentication identifiers, the resumes and photos you choose to save, and the identifiers and revision information needed for sync are processed in Supabase's authentication, database and private Storage in Seoul (ap-northeast-2). They are used for sign-in and for saving and restoring documents across devices, and access by other users to your documents is blocked. Account storage and device storage must be deleted separately.

PDF generation: the document and photos you request are processed by the Web and PDF Worker on Render in Singapore, and jobs and results use Supabase private storage. Job input is removed when the job succeeds or fails, and generated PDFs expire after 1 hour. Expired files are physically deleted by a cleanup job, so the time access expires and the time of actual deletion may differ. The request session cookie is kept for up to 24 hours.

Deleting documents and accounts: when you request deletion, access is blocked and linked PDFs are discarded. Maintenance jobs then clean up photos and the authentication account in sequence, retrying if a step fails. So that deleted documents are not restored by sync from another device, a deletion record consisting only of account and document identifiers and the deletion time is kept for as long as the service operates. This record contains no email address, document content or photos, and it is destroyed when the service ends. Copies remaining in a cloud provider's own backups are deleted according to that provider's retention cycle. Users must delete downloaded files and local copies on other devices themselves.

Contact form: only the reply email address, the message, the submission identifier and time, and the handling status, completion date and scheduled deletion date are stored in a private Supabase inbox. They are used to handle and reply to inquiries and are seen only by the operator. They are kept while the inquiry is being handled and are deleted by a cleanup job 90 days after it is resolved. Do not include unnecessary resume text, photos or sensitive information in an inquiry. Deletion requests are accepted at the privacy contact address.

Email: Resend processes email addresses and authentication messages to send authentication emails. Mail received at support@vitawrite.com and privacy@vitawrite.com is forwarded by ImprovMX to the operator's inbox. ImprovMX is used only for receiving and forwarding; authentication emails are sent through Resend. Email inquiries are also subject to an operating procedure under which they are kept in the operator's inbox for 90 days after resolution and then deleted.

Processing outside Korea (processing and storage entrusted to providers to deliver the service): ① Render Services, Inc. — Singapore region; resume content and photos during web request handling and PDF generation; processed when you use the service and kept until the PDF retention period above. ② Supabase, Inc. — Seoul region (ap-northeast-2); storage of accounts, cloud documents, photos and inquiries; until account deletion or the retention periods above. ③ Resend, Inc. — United States; email addresses and authentication messages for sending authentication emails; until the provider's retention period (30 days according to its public documentation). ④ ImprovMX — receiving and forwarding email sent to the official contact addresses; until the provider's log retention period after forwarding. ⑤ Google LLC (Google Analytics) — United States; visit statistics if you consent to analytics cookies; 2 months from collection. Each of these takes place over the network at the time the user uses the relevant feature. If you do not want processing outside Korea, you can choose not to use account storage, PDF generation or email inquiries, but you will then be unable to use those features. Visit statistics are not sent if you decline them in the cookie choices. If advertising is enabled, Google's processing will be added to this policy first.

Advertising and analytics: Google AdSense has been chosen as the advertising provider, but ads are currently disabled. Before enabling them, we will verify the data Google processes and its policies, regional consent requirements and the CMP, and update this notice. Visit statistics are collected with Google Analytics only if you choose 'Accept all' in the cookie choices. The data collected is the type of page visited (the address with document identifiers removed), browser and device information, approximate location, and usage events (such as template selection and PDF requests), and it is used to improve the service. Resume content, email addresses and account information are not sent, and Google signals and ad personalization features are not used. Collected data is kept in Google Analytics for 2 months and then deleted. Session replay is not used. Optional consent can be withdrawn at any time.

Operations and security: faults are investigated using request identifiers and success/failure categories, and resume text, authentication tokens and inquiry contents are not recorded in application logs. For abuse prevention, a rate-limiting identifier computed with a secret key is used instead of the raw IP address, and a shared limit is applied when there is no trusted proxy. Hosting providers' own access logs and backups are handled under each provider's retention policy.

Users may at any time request access to, correction or deletion of, or suspension of processing of their personal information. Requests sent to privacy@vitawrite.com will be answered with the outcome without delay. Contact for personal information inquiries: the operator, Youngrae Cho (조영래) (privacy@vitawrite.com). When this policy changes, the version, last updated date and effective date are shown on this page, and important changes are announced before they take effect. This policy does not limit procedures required by law or users' rights.