Skip to content
    Cryptodamby Stupore
    Legal

    Privacy Policy

    Effective 7 October 2026. Replaces the version effective 17 March 2026, which is available on request.

    This policy explains how personal information is handled on www.stuporeinvestment.com and in the services offered there: CryptoDam, Stupore, Hailey, AgentGuard and Genesis (the “Services”). It is written to meet Korea’s Personal Information Protection Act (PIPA) and, for people in the European Economic Area (EEA) and the United Kingdom, the GDPR and UK GDPR.

    Who is responsible: the Services are run under the name Stupore Investment by an individual operator who has not yet registered a business (“we”, “us”). We decide why and how your personal information is processed, so we are the personal information controller (data controller). Contact: stuporeinvestment.kj@gmail.com.

    In short:

    • We process what we need to run your account and the features you use. We do not sell personal information or use it for advertising.
    • Analytics run only if you accept them under “Privacy choices”. We treat a Global Privacy Control signal as a refusal.
    • Our database is stored in Supabase’s Seoul (Korea) region. Some providers that help us are in the United States (section 5).
    • We never ask for wallet recovery phrases (seed phrases) or private keys. Never send them to us in any form.
    • You can ask to see, correct or delete your information by emailing stuporeinvestment.kj@gmail.com. We reply within 10 days.

    1. What we process, why, and on what basis

    “Contract” means the processing is needed to provide a service you asked for (PIPA Article 15(1)(4); GDPR Article 6(1)(b)), so no separate consent is needed. “Legitimate interest” means processing we need to keep the Services secure and to resolve disputes, which we have weighed against your rights (PIPA Article 15(1)(6); GDPR Article 6(1)(f)). “Consent” means we process only if you agree, and you can withdraw at any time (PIPA Article 15(1)(1); GDPR Article 6(1)(a)).

    Purpose
    Your account: create it, sign you in and keep it secure
    Information
    Email address; password (kept only as a one-way hash by our sign-in provider); display name. If you choose Google sign-in: your Google account ID, name, email address and profile picture. Sign-in records (time, IP address, browser).
    Basis
    Contract; legitimate interest for sign-in records
    How long we keep it
    Until you delete your account. Sign-in records are deleted with the account.
    Purpose
    Profile and published content (Hailey)
    Information
    Display name, bio, profile picture, posts you publish, follows, contributor applications. Profile pictures and published posts are public.
    Basis
    Contract
    How long we keep it
    Until you delete them or your account.
    Purpose
    Protection and incident services (CryptoDam): plans, incidents, evidence, recovery steps and payouts
    Information
    Plan and enrolment status and dates; wallet addresses and transaction hashes you give us; incident descriptions; evidence files; recovery notes and freeze instructions; payout records; your organisation and role.
    Basis
    Contract; legitimate interest for resolving disputes and legal claims
    How long we keep it
    While your account exists, and up to 5 years after the incident is closed or the plan ends. Then deleted.
    Purpose
    Questions and requests: contact, partnership, newsletter-interest and privacy requests; Genesis access requests
    Information
    Name, email address, company, role, inquiry type and message. For Genesis also intended use, product interest, expected users, budget range and timeline.
    Basis
    Steps you ask us to take before a contract; legitimate interest in replying to you
    How long we keep it
    3 years after our last contact with you. Then deleted.
    Purpose
    Business partners and API users
    Information
    API key records (kept as a hash), the IP address that last used each key, API request logs, webhook addresses and delivery records.
    Basis
    Contract with the business customer; legitimate interest for security
    How long we keep it
    While the partner account is active and 1 year after it ends.
    Purpose
    AI assistant with your own AI provider key
    Information
    The messages you send and the app records the assistant needs to answer; your provider API key (stored encrypted with AES-256-GCM).
    Basis
    Contract (a feature you turn on)
    How long we keep it
    Conversations are kept in your browser, not on our servers, and removed when you sign out. Your key is kept until you remove it or delete your account.
    Purpose
    Security and audit records
    Information
    User ID, the action taken, the time, and before-and-after values of records you change.
    Basis
    Legitimate interest; legal obligations
    How long we keep it
    Up to 5 years. Then deleted.
    Purpose
    Optional analytics: how the site is used and how fast pages load
    Information
    Page address (with sign-in data removed), referrer, browser, operating system, device type, approximate location (country, region and city), network speed and page-speed measurements.
    Basis
    Consent (“Accept analytics”)
    How long we keep it
    Collected only after you accept. Vercel stores these measurements without linking them to you (section 7).

    We do not intentionally collect resident registration numbers or other unique identification numbers, or sensitive information such as health data or political opinions. Please leave them out of messages and evidence unless your case needs them.

    If you do not give us information needed for a service, we cannot provide that service. Analytics are always optional.

    2. How long we keep information and how we delete it

    We keep personal information only for the periods in section 1. When a period ends or its purpose is achieved, we delete the information without undue delay.

    If a law requires us to keep information longer, or we need it for an ongoing dispute or legal claim, we keep only what is needed, limit access to the operator, and delete it when the need ends.

    Electronic records are deleted from our database and file storage so they cannot be restored through the Services. Backups held by our hosting provider expire on that provider’s schedule. We do not keep paper records; anything printed is shredded.

    3. When others receive your information

    We do not sell personal information and do not share it for advertising. Others receive it only in these cases:

    • Your organisation: if you use CryptoDam through an organisation (for example a partner that offers protection to you), people in that organisation with the right role can see the records needed to handle your plan and incidents.
    • Public content: the profile and posts you publish on Hailey are visible to everyone.
    • Services you choose: if you sign in with Google, or connect your own AI provider (OpenAI, Anthropic or Google), the information needed goes to that company under your own account with it.
    • When a law requires it, or with your separate consent.

    4. Service providers who process information for us

    Provider
    Supabase, Inc.
    What they do for us
    Database, sign-in, file storage and server functions. Our database is stored in the Seoul (Korea) region.
    Provider
    Vercel Inc.
    What they do for us
    Website hosting and delivery. With your consent: Vercel Web Analytics and Vercel Speed Insights.
    Provider
    Google LLC
    What they do for us
    With your consent: Google Tag Manager. It is currently configured with no tags.
    Provider
    OpenAI OpCo, LLC
    What they do for us
    Drafting an assessment of Genesis access requests, and draft replies. A person reviews every draft before any decision or message.

    Providers may use the information only to provide their service to us, under their data processing terms. We will update this policy before we add a provider.

    5. Transfers outside Korea

    Some providers process information outside Korea. Under PIPA Article 28-8(1)(3) we transfer information needed to provide the Services under our contract with you by disclosing the details below. For optional analytics we rely on your consent.

    For people in the EEA and UK: our database is stored in Korea, which the European Commission and the UK have recognised as providing adequate protection. Transfers to the United States rely on the providers’ data processing terms, which include the European Commission’s Standard Contractual Clauses.

    Recipient and contact
    Supabase, Inc. (privacy@supabase.com)
    Country
    Stored in Korea; may be accessed from the United States and other countries where Supabase and its sub-processors operate
    Information
    Information in section 1 that is stored in our database or file storage
    When and how
    Whenever you use the Services; encrypted network transmission
    Purpose
    Hosting, sign-in and support
    How long the recipient keeps it
    The periods in section 1
    Recipient and contact
    Vercel Inc. (privacy@vercel.com)
    Country
    United States and Vercel’s global delivery network
    Information
    IP address, browser and device information, pages requested; the analytics items in section 1 only with consent
    When and how
    Each time you visit; encrypted network transmission
    Purpose
    Website hosting and delivery; optional analytics
    How long the recipient keeps it
    Request logs for Vercel’s short log period; analytics stored without linking them to you
    Recipient and contact
    Google LLC (contact options at policies.google.com/privacy)
    Country
    United States
    Information
    IP address, browser information, page address
    When and how
    When a page loads after you accept analytics; encrypted network transmission
    Purpose
    Google Tag Manager (no tags configured)
    How long the recipient keeps it
    Under Google’s retention rules
    Recipient and contact
    OpenAI OpCo, LLC (dsar@openai.com)
    Country
    United States
    Information
    Genesis request fields: name, email address, organisation, role, intended use, product interest, expected users, budget range, timeline and message
    When and how
    When we run the assessment on a submitted request; encrypted connection
    Purpose
    Drafting the assessment and a reply for human review
    How long the recipient keeps it
    Up to 30 days for abuse monitoring; not used to train OpenAI’s models

    How to refuse: you can refuse the transfers needed for the Services only by not using them or deleting your account, because the Services cannot run without these providers. You can refuse analytics at any time under “Privacy choices”. To have a Genesis request reviewed without the AI step, say so in your request or email us.

    6. How we protect information

    • Access: administrative functions are limited to accounts with an administrator role. Database rules limit each record to the people allowed to see it, and roles in the app limit what each user can open.
    • Encryption: connections use HTTPS (TLS). Passwords are kept only as one-way hashes. AI provider keys are encrypted with AES-256-GCM, and partner API keys are kept as hashes. Our database provider encrypts stored data.
    • Extra sign-in check: if you turn on multi-factor authentication, protection records can only be opened in a session that has passed it.
    • Records: important actions are written to an audit log. Webhook error logs are filtered to remove personal and secret values.
    • Facilities: our data is held in our providers’ data centres, which control physical access.

    7. Cookies, browser storage and analytics

    We do not use advertising cookies or collect behavioural information for targeted advertising.

    Always on, because the Services need them: your sign-in session, your language, and your privacy choice, kept in your browser’s storage. While you are signed in, your assistant conversations, unpublished drafts and recent searches are also kept on your device so you can resume them; they are removed when you sign out.

    Only after you choose “Accept analytics”:

    • Vercel Web Analytics: page views without cookies. A visit is recognised by a hash of the request that is discarded after 24 hours.
    • Vercel Speed Insights: page-speed measurements that are not linked to you.
    • Google Tag Manager: currently configured with no tags. When it loads, Google receives your IP address and browser information.

    How to refuse: use “Privacy choices” at the bottom of every page. You can also block or delete site data in your browser: Chrome: Settings > Privacy and security > Site settings. Edge: Settings > Cookies and site permissions. Safari: Settings > Privacy. Firefox: Settings > Privacy & Security. Blocking all storage for this site stops sign-in from working.

    8. Your rights and how to use them

    You can ask to see your personal information, correct it, delete it or stop its processing, and you can withdraw consent at any time. If you are in the EEA or UK, you can also ask us to restrict processing, object to processing based on legitimate interest, and receive the information you gave us in a portable format.

    • Email stuporeinvestment.kj@gmail.com from the address on your account, or tell us how we can confirm it is you. You can also use the Contact page and choose “Legal / Privacy”.
    • In the app you can edit your profile and remove your profile picture. Signing out removes your assistant conversations, drafts and recent searches from your device.
    • Someone acting for you, such as a legal representative or a person you authorise, can make a request with proof of authority (for example a power of attorney).
    • We reply within 10 days of receiving your request. If we refuse or limit a request because a law allows or requires it, we tell you why and how to object.
    • Requests are free. Withdrawing consent does not affect processing that happened before.

    9. Children

    The Services are for people aged 14 and over. We do not knowingly collect personal information from children under 14. If we learn that we have, we delete it. A parent or guardian who believes a child under 14 has given us information can contact us.

    10. Automated decisions and AI

    We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. For Genesis access requests an AI service may draft an assessment, but a person makes every decision and reviews every message before it is sent. We do not use your personal information to train AI models.

    11. Privacy officer

    Privacy officer: the operator of Stupore Investment. Email: stuporeinvestment.kj@gmail.com. Questions, complaints and requests about personal information are handled at this address.

    12. Where else to get help

    In Korea you can contact:

    In the EEA you can complain to the data protection authority where you live or work (list at edpb.europa.eu). In the UK you can complain to the Information Commissioner’s Office (ico.org.uk).

    13. Changes to this policy

    We post every new version on this page with its effective date. If a change adds purposes, information, providers or transfers, or reduces your rights, we announce it on the site at least 7 days before it takes effect and ask for consent where the law requires it.