Privacy Policy
Effective October 21, 2026
In short. We keep what running your simulations needs — nothing for advertising, nothing sold. What you hand over is never used to train AI models, ours or anyone else’s. Screen images are deleted after 30 days. Your information goes only to the companies in section 4, which run Prefigure for us. You can see, correct or delete it at any time.
- Who is responsible
- What we collect, why, and for how long
- What the AI does with your content
- Who processes it for us, and transfers abroad
- When others can see it
- Deleting
- Your rights, and how to use them
- Cookies
- Security
- Children
- Other people in your content and in our research
- The person responsible for privacy
- If you are not satisfied
- Changes to this policy
1. Who is responsible
Salt and Code (솔트앤코드), a sole proprietorship registered in the Republic of Korea (business registration 373-24-02334; B1 4-S9, 306 Apgujeong-ro, Gangnam-gu, Seoul, Republic of Korea), runs Prefigure and decides how the personal information in it is used — under Korea’s Personal Information Protection Act (PIPA) we are its personal information controller, and where the EU or UK GDPR applies, its controller. This policy covers prefigure.net and the Prefigure connector used from AI assistants. Questions: by email at support@saltandcode.net.
2. What we collect, why, and for how long
| What | Why | How long |
|---|---|---|
| Account: your Google email and account id. Google’s sign-in also gives our sign-in service your name and picture; we do not use them. | Signing you in, your workspace, answering you | Until you delete your account |
| Your agreement: which version of the terms and this policy you agreed to (14 or older), and when | Showing what you agreed to | Until you delete your account; if you paid, as long as the payment records |
| What you hand over: screen images, their text, flows, product and audience descriptions, your answers to the test plan | Running your simulations and showing the reports | Screen images: 30 days after hand-over. The rest: until you delete the simulation or your account |
| Simulations and reports: the simulated people, results, interviews, and a sealed copy of each prediction | Showing and sharing your reports; scoring predictions honestly against what really happened | Until you delete the simulation or your account |
| Public web research: short excerpts of public posts (up to 150 characters) with their address and title — which may include the author’s name | Showing who the simulated people stand for | With the simulation; sooner if the author asks |
| What really happened, if you or someone you share a report with tells us: what shipped, a metric, numbers before and after, a note | Measuring how accurate Prefigure is | With the simulation |
| Connections: when each was made, its last four characters, the simulations it ran, and — for an address made without signing in — the agreement ticked. Secrets, codes and tokens only as one-way hashes | Letting your AI assistant use Prefigure as you | Until you delete your account (a removed connection stops working at once). Sign-in tokens expire within 90 days |
| Credits and payments: the credit ledger; Paddle’s customer, subscription and transaction ids, amounts, dates and refunds. Never card numbers or addresses | Credits, receipts, refunds, tax and accounting | 5 years (Act on Consumer Protection in Electronic Commerce) |
| Visit records: the pages you see on the site and the steps you take there (for example the sample opened, the film played, a connection made, the checkout opened), the link’s tags and the site that sent you, phone or computer, country, and a code that changes every day — made from that day, your IP address and your browser with a secret key, so it cannot be turned back into either. No cookie and no IP address is stored, and nothing is recorded when your browser asks not to be tracked. | Seeing where visitors come from and where they stop, to make the site better | 180 days |
| Emails to us: your address and what you write | Answering you; handling complaints and disputes | 3 years (records of complaints and disputes, the same Act) |
| A link sent to your computer: the email address you type on a phone to get the link to set up Prefigure | Sending you that one link | Not kept: used once to send the link (and, for an hour, a one-way hash of it to stop the same address being sent the link again and again). Resend keeps its delivery record (section 4) |
| The Pro waiting list (closed when payments opened): an email and an optional note | Telling you when Pro opened | 1 year |
| Security: IP addresses with the times of rate-limited requests — making an address (also how many with a free first run were made from one network that day), an app signing in, a translation, an unknown connection address, a link sent to a computer | Stopping abuse (rate limits) | 1 day — deleted at the next daily clean-up |
| Service alerts to us and server logs: what failed, which may name your account email, a simulation, a screen or a payment id | Fixing failures and payment problems | Alerts: 90 days. Logs: a few days, by our host |
Where it comes from. From you (what you type and hand over), from Google when you sign in with it, from Paddle when you pay, from your AI assistant when it uses Prefigure for you (only what it sends to Prefigure), and automatically as you use the site (IP address and request times, and the visit records above).
Why we may. We process it because it is needed to provide Prefigure under our agreement with you (PIPA Art. 15(1)4; GDPR Art. 6(1)(b)), because the law requires us to keep some records (PIPA Art. 15(1)2; GDPR Art. 6(1)(c)), and — for security, stopping abuse and measuring how accurate Prefigure is — because of our legitimate interest, which does not override yours (PIPA Art. 15(1)6; GDPR Art. 6(1)(f)). When you tick the box at sign-in you also confirm you have read this policy.
What we do not do. We do not collect sensitive information (such as health or beliefs), resident registration numbers or other national identifiers. We do not sell personal information, show ads, build advertising profiles, or use third-party analytics or advertising trackers — the visit records above are our own, kept with us, and use no cookie. We use information only for the purposes above; statistics we draw from simulations to measure accuracy are combined and contain no personal information. We make no decisions about you by automated means alone that have legal or similarly significant effects; and we do not process pseudonymized information.
3. What the AI does with your content
- To run a simulation, Prefigure sends what you hand over to AI models: Anthropic’s Claude describes your audience’s groups, reads your screens, plays the simulated people and writes the report — and, only for a simulation that uses web research, searches the public web for what people like your audience write; Google’s Gemini reads each screen independently and, with Claude, checks the most important results as a second, separate judge.
- Both are used through their paid API services, whose terms do not let them use your content to train or improve their models. They keep it only for the limited time their terms allow, to detect abuse and meet the law (see section 4).
- The simulated people are fictional. They are not profiles of real people; they are built from how people like your audience typically behave. When a simulation uses web research, the searches use your product’s name, what it does and who it is for — not your screens.
- When you use Prefigure from your own AI assistant, that assistant’s provider handles your conversation under its own privacy policy. We receive only what the assistant sends to Prefigure.
4. Who processes it for us, and transfers abroad
Prefigure runs on the services below. They process personal information on our behalf, only for the purpose shown, under data-processing terms that bind them to follow our instructions, keep it secure and not use it for themselves; we oversee them as the law requires. Most are outside Korea, so using Prefigure transfers your information abroad: when — as you use Prefigure; how — over the internet, encrypted in transit (TLS). Because these transfers are needed to provide Prefigure under our agreement with you, we disclose them here (PIPA Art. 28-8(1)3); where the GDPR applies, they rely on adequacy decisions or the providers’ Standard Contractual Clauses.
Refusing: you can refuse the transfer by not handing over content or by deleting your account (section 6) — but Prefigure runs on these services and cannot work without them.
| Company (contact) | Where | What it does for us | What it receives | How long it keeps it |
|---|---|---|---|---|
| Anthropic, PBC privacy contact | USA | AI model (Claude): describes your audience’s groups, reads your screens, plays the simulated people, checks results, writes reports; searches the public web only for simulations that use web research | Screen images and text, flows, product and audience descriptions, test-plan answers — per simulation. When a simulation uses web research, its searches carry the product’s name, what it does, who it is for and its market’s country | Not used for training (Anthropic’s commercial terms); kept only for the limited time its API terms allow, to detect abuse and meet the law |
| Google LLC — Gemini API privacy contact | USA and other countries where Google processes data | AI model (Gemini): reads each screen independently and, with Claude, checks the most important results as a separate judge | Screen images and text, the journey, and the changes a report proposes — per simulation | Paid service: not used to improve Google’s products; kept only for a limited time, to detect abuse and meet the law |
| Supabase, Inc. privacy contact | USA (AWS, East US — Ohio) | Database, file storage and sign-in | Everything Prefigure keeps (section 2) | As long as we keep it (section 2) |
| Netlify, Inc. privacy contact | USA | Hosting the website, the connector and the background work | Every request as it passes; server logs | Logs for a few days, under its plan |
| Paddle.com Market Ltd privacy contact | United Kingdom | Payments, as the seller of record: checkout, receipts, tax, refunds | Your email (we pass it to the checkout) and what you enter there — card, country, address | Under Paddle’s policy and tax law |
| GitHub, Inc. privacy contact | USA | Nightly backups, reachable only by us, so nothing is lost if a service fails | Account, workspace, credit and simulation data and the list of sign-in users — not screen images | 14 days |
| Google LLC — Google Fonts privacy contact | USA | Fonts for the site, and the letters of a report’s share picture | Your IP address and browser details when your browser loads fonts; the words on a share picture (product name, answer, first fix) when it is drawn | Under Google’s policy |
| jsDelivr privacy contact | Worldwide (content delivery network) | A font file (Pretendard) | Your IP address and browser details when your browser loads it | Under jsDelivr’s policy |
| Microlink (Kikobeats S.L.) privacy contact | Spain | Photographing a public web page, only when our own browser fails | The page’s public address and screen size | Under Microlink’s policy |
| ImprovMX privacy contact | USA | Forwards the email you send to our address | Emails you send us | Under ImprovMX’s policy |
| Google LLC — Gmail privacy contact | USA | The mailbox where we read and answer your emails | Emails you send us, and our replies | 3 years (section 2) |
| Plus Five Five, Inc. (Resend) privacy contact | USA | Emails you a sign-in link, or the link to set up Prefigure on your computer, when you ask for one, and emails service alerts to us | Your email address and the link; alerts, which may name your account email, a simulation or a payment id | Under Resend’s policy |
Payments: Paddle is the seller of record for your purchase, so it also handles your payment details as an independent controller under its own privacy notice. We never see card numbers.
5. When others can see it
We do not give personal information to third parties, except:
- Links. Anyone with a report’s link can open it — or a product’s link, before it has a simulation — unless you set the report to “Only you can open it” in My space. Screen images have addresses of their own that are hard to guess, and stop working when the images are deleted. A report shows what you handed over and the results — never your account email.
- When the law requires it — for example a court order or a lawful request from an authority. We check the request and give only what is required.
- To protect life or safety in an emergency, where the law allows.
- If Prefigure changes hands — the new owner takes on this policy, and we tell you first so you can delete your account.
6. Deleting
- Screen images are deleted automatically 30 days after they are handed over.
- A simulation can be deleted at any time — ask your assistant to delete it — together with its report.
- Your account: ask us by email at support@saltandcode.net and we delete your account, workspace, simulations and connections within 10 days.
- Kept apart when the law requires: payment and credit records (5 years) and records of complaints and disputes (3 years), under the Korean Act on Consumer Protection in Electronic Commerce. They are stored separately and used for nothing else.
- How: electronic records are deleted so they cannot be restored; copies in our backups expire within 14 days. We keep no paper records.
7. Your rights, and how to use them
You can ask to see, correct or delete your personal information, to stop or limit its processing, to take a copy of what you handed over and your reports, to object, and to withdraw any consent you gave. Many of these you can do yourself in My space (who can open a report, connections) or by asking your assistant (deleting a simulation); for the rest, write to us by email at support@saltandcode.net.
- We answer within 10 days. We may ask you to confirm it is you, usually by writing from your account email.
- Someone else may ask for you — a legal guardian, or a person you authorize in writing.
- If the law lets or makes us refuse (for example, records we must keep), we tell you why and how to object.
- You must keep your own information correct and not use other people’s.
8. Cookies
Prefigure uses only the cookies it needs to work — none for analytics, advertising or tracking across sites:
| Cookie | What it does | How long |
|---|---|---|
| sb-…-auth-token | Keeps you signed in (set by our sign-in service, Supabase Auth) | Until you sign out, at most 400 days |
| sb-…-code-verifier | Protects the sign-in while it happens (PKCE) | While you sign in |
| pf_consent | Carries the box you ticked to the sign-in step, where it is recorded | 10 minutes; removed at sign-in |
| pf_next | Where to take you after signing in | 10 minutes; removed at sign-in |
| prefigure.mcp (browser storage) | The private address you made on this browser, so My space can add it to your account | Until you clear your browser’s storage |
| pf_paid_from (browser storage, this tab) | Your credit balance before a payment, to show what it added | Until the payment shows, or the tab closes |
| Paddle (Pricing page, when you buy) | Paddle’s checkout may set its own cookies — see Paddle’s policy | Set by Paddle |
You can block or delete cookies in your browser’s settings, but then you cannot sign in.
9. Security
- In transit: everything travels encrypted (HTTPS/TLS), between you and us and between us and our providers.
- At rest: data sits in storage encrypted by our provider, reachable only by our server; the keys to it are kept out of our code.
- Secrets: sign-in tokens and codes are stored only as one-way hashes; each connection has its own secret and can be removed at any time.
- Access: only the person responsible for privacy (section 12) can reach production data, and only as needed.
- Abuse: rate limits and spending caps protect the service; the IP addresses they use are deleted after a day.
- If something goes wrong: if personal information leaks, we tell the people affected and, where the law requires, the Personal Information Protection Commission — within 72 hours of learning of it.
10. Children
Prefigure is not for anyone under 14, and we do not knowingly collect their information. If we learn that we have, we delete it.
11. Other people in your content and in our research
- In your screens. Please use sample data. If real people’s names, photos or contact details appear in what you hand over, you are responsible for being allowed to share them; screen images are deleted after 30 days either way.
- In our research. Reports may quote short excerpts of public posts, with their source, to show who the simulated people stand for. If you wrote one and want it removed, write to us — we remove it within 10 days.
- Simulated people. They are fictional. If one seems to be you, tell us and we will change it.
12. The person responsible for privacy
Privacy officer (also handling requests to see your information): Junsu Lee (이준수), Representative of Salt and Code — by email at support@saltandcode.net. We are based in Korea, so no separate domestic representative is needed.
13. If you are not satisfied
Please write to us first. You can also contact these Korean bodies for help or to report a problem:
| Body | Phone | Website |
|---|---|---|
| Personal Information Dispute Mediation Committee | 1833-6972 | www.kopico.go.kr |
| Personal Information Infringement Report Center (KISA) | 118 | privacy.kisa.or.kr |
| Supreme Prosecutors’ Office | 1301 | www.spo.go.kr |
| Korean National Police Agency, Cyber Bureau | 182 | ecrm.police.go.kr |
If you live in the European Economic Area or the United Kingdom, you can also complain to your local data protection authority.
14. Changes to this policy
When we change this policy we post the new text here with its date. For changes that matter to you we tell you by email or in My space at least 7 days before they apply — 30 days if a change is against your interests. Earlier versions are available on request.
- October 21, 2026: Sending the link to your computer added: the email you type on a phone is used once to send it and not kept; Resend sends it.
- October 17, 2026: Visit records added: the pages and steps on the site, where a visit came from, and a code that changes daily — no cookie and no IP address stored, kept 180 days. Signing in by an emailed link added: Resend sends it.
- October 15, 2026: The simulated people are built from how people like your audience typically behave; the public web is searched only for simulations that use web research.
- October 4, 2026: Rewritten in full, with a Korean text. Google (Gemini API) added as a processor; every service, cookie and retention period listed.
- September 29, 2026: First version.