Legal

Privacy Policy

Effective 25 October 2026; posted 18 October 2026. It replaces the version effective 7 October 2026, which applies until then and differs only by the AI assistant connector (sections 1, 3 and 5). Earlier versions are available on request.

This policy explains how personal information is handled on www.stuporeinvestment.com and in the services offered there: CryptoDam, Stupore, Hailey, AgentGuard and Genesis (the “Services”). It is written to meet Korea’s Personal Information Protection Act (PIPA) and, for people in the European Economic Area (EEA) and the United Kingdom, the GDPR and UK GDPR.

Who is responsible: KYUNG JIN KIM operates the Services under the name Stupore Investment (“we”, “us”) and decides why and how your personal information is processed as the personal information controller (data controller). Contact: stuporeinvestment.kj@gmail.com.

Operator identity clarification: 30 October 2026. This identifies the same operator; it changes no processing purpose, recipient, retention period or privacy right.

In short:

We process what we need to run your account and the features you use. We do not sell personal information or use it for advertising.
Analytics run only if you accept them under “Privacy choices”. We treat a Global Privacy Control signal as a refusal.
Our database is stored in Supabase’s Seoul (Korea) region. Some providers that help us are in the United States (section 5).
We never ask for wallet recovery phrases (seed phrases) or private keys. Never send them to us in any form.
You can ask to see, correct or delete your information by emailing stuporeinvestment.kj@gmail.com. We reply within 10 days.

Posted 19 October 2026; effective 26 October 2026. This addition supplements the policy below and does not change the AI connector version posted 18 October, effective 25 October.

When you choose to use private messaging on Silver Ocean Hailey, we store the participants’ account identifiers, message text and timestamps, conversation and read-position records, blocks, and submitted reports and report details. We use them to deliver conversations, show unread messages, enforce blocking and abuse limits, and handle reports.

Conversation participants can read their conversations. Authorized moderators can review reported messages and related report details. Messages are not end-to-end encrypted. Privileged service operators can access stored records when needed to operate and secure the service. This messaging feature does not send message text to market-data providers, AI providers or optional analytics.

Conversation data is retained until either participant’s service account is deleted. Removing a public profile or blocking a member does not delete conversation history. Reports and reported message text are removed with their associated conversation; separate security and audit records follow the retention rules below. Provider backups expire on the provider’s schedule, as described below. There is no automatic message-expiry schedule in this release.

Account deletion is handled through the existing privacy-request process. Contact the privacy address below to request access or deletion; this addition does not introduce a self-service message or account deletion control.

Google Analytics 4, when enabled, measures public page views only after you accept optional analytics in Privacy choices. Google receives online cookie identifiers, page-view events, IP address and browser/device information and may derive approximate location. Our pageview events use static public-page addresses and titles; they exclude private workspace paths, URL queries, fragments, referrers, account identifiers and message content. Google advertising signals and advertising personalization are disabled in the application configuration.

Recipient and contact: Google LLC (contact options at policies.google.com/privacy)
Country: United States
Information and purpose: Cookie identifiers, public page-view events, IP address and browser/device information for optional Google Analytics 4 public-page measurement.
When and how: When enabled, after analytics consent and while using measured public pages; encrypted network transmission.
Retention: The property is configured for two-month detailed user/event retention. This setting does not set cookie expiry or remove standard aggregated reports, which may remain longer. Google’s processing terms also apply.

Additional Google processing and overseas transfer
Recipient and contact	Country	Information and purpose	When and how	Retention
Google LLC (contact options at policies.google.com/privacy)	United States	Cookie identifiers, public page-view events, IP address and browser/device information for optional Google Analytics 4 public-page measurement.	When enabled, after analytics consent and while using measured public pages; encrypted network transmission.	The property is configured for two-month detailed user/event retention. This setting does not set cookie expiry or remove standard aggregated reports, which may remain longer. Google’s processing terms also apply.

The stream uses Google’s default analytics-cookie settings: the _ga cookies have a configured two-year expiry, renewed by activity. Browser restrictions may shorten their lifetime. This cookie setting is separate from the two-month detailed event-retention setting. Enhanced Measurement is off; the application sends the public pageview events. This addition extends the Google provider and transfer disclosures below to GA4; the older empty Tag Manager container is not the GA4 measurement implementation.

You may refuse or withdraw optional analytics through Privacy choices. The application treats Global Privacy Control as a refusal. Withdrawal stops further collection through the application; it does not automatically erase existing Google cookies or data already collected by Google. Existing cookies can be removed through your browser controls. Turning on GA4 requires a new explicit analytics choice rather than reusing the earlier tagless-analytics consent.

1. What we process, why, and on what basis

“Contract” means the processing is needed to provide a service you asked for (PIPA Article 15(1)(4); GDPR Article 6(1)(b)), so no separate consent is needed. “Legitimate interest” means processing we need to keep the Services secure and to resolve disputes, which we have weighed against your rights (PIPA Article 15(1)(6); GDPR Article 6(1)(f)). “Consent” means we process only if you agree, and you can withdraw at any time (PIPA Article 15(1)(1); GDPR Article 6(1)(a)).

Purpose: Your account: create it, sign you in and keep it secure
Information: Email address; password (kept only as a one-way hash by our sign-in provider); display name. If you choose Google sign-in: your Google account ID, name, email address and profile picture. Sign-in records (time, IP address, browser).
Basis: Contract; legitimate interest for sign-in records
How long we keep it: Until you delete your account. Sign-in records are deleted with the account.

Purpose: Profile and published content (Hailey)
Information: Display name, bio, profile picture, posts you publish, follows, contributor applications. Profile pictures and published posts are public.
Basis: Contract
How long we keep it: Until you delete them or your account.

Purpose: Protection and incident services (CryptoDam): plans, incidents, evidence, recovery steps and payouts
Information: Plan and enrolment status and dates; wallet addresses and transaction hashes you give us; incident descriptions; evidence files; recovery notes and freeze instructions; payout records; your organisation and role.
Basis: Contract; legitimate interest for resolving disputes and legal claims
How long we keep it: While your account exists, and up to 5 years after the incident is closed or the plan ends. Then deleted.

Purpose: Questions and requests: contact, partnership, newsletter-interest and privacy requests; Genesis access requests
Information: Name, email address, company, role, inquiry type and message. For Genesis also intended use, product interest, expected users, budget range and timeline.
Basis: Steps you ask us to take before a contract; legitimate interest in replying to you
How long we keep it: 3 years after our last contact with you. Then deleted.

Purpose: Business partners and API users
Information: API key records (kept as a hash), the IP address that last used each key, API request logs, webhook addresses and delivery records.
Basis: Contract with the business customer; legitimate interest for security
How long we keep it: While the partner account is active and 1 year after it ends.

Purpose: AI assistant with your own AI provider key
Information: The messages you send and the app records the assistant needs to answer; your provider API key (stored encrypted with AES-256-GCM).
Basis: Contract (a feature you turn on)
How long we keep it: Conversations are kept in your browser, not on our servers, and removed when you sign out. Your key is kept until you remove it or delete your account.

Purpose: Connecting ChatGPT, Claude or another AI assistant to your account (the AI connector)
Information: The connection: which assistant, the permissions you approved, when you approved it and when it was last used; one-way hashes of its access and refresh tokens (never the tokens themselves). What the assistant reads with your permission: CryptoDam reference information, and with “watchlist and alerts” your Hailey watchlist and alerts. We do not keep your conversations with the assistant or the requests it sends.
Basis: Consent (you approve each connection on our consent screen)
How long we keep it: Until you disconnect, the connection ends, or you delete your account. Requests, codes and tokens are deleted a day after they can no longer be used; a replaced refresh token is kept until it would have expired (30 days) so its reuse can be detected. Approvals, denials and disconnections stay in the security and audit records.

Purpose: Security and audit records
Information: User ID, the action taken, the time, and before-and-after values of records you change.
Basis: Legitimate interest; legal obligations
How long we keep it: Up to 5 years. Then deleted.

Purpose: Optional analytics: how the site is used and how fast pages load
Information: Page address (with sign-in data removed), referrer, browser, operating system, device type, approximate location (country, region and city), network speed and page-speed measurements.
Basis: Consent (“Accept analytics”)
How long we keep it: Collected only after you accept. Vercel stores these measurements without linking them to you (section 7).

Personal information we process
Purpose	Information	Basis	How long we keep it
Your account: create it, sign you in and keep it secure	Email address; password (kept only as a one-way hash by our sign-in provider); display name. If you choose Google sign-in: your Google account ID, name, email address and profile picture. Sign-in records (time, IP address, browser).	Contract; legitimate interest for sign-in records	Until you delete your account. Sign-in records are deleted with the account.
Profile and published content (Hailey)	Display name, bio, profile picture, posts you publish, follows, contributor applications. Profile pictures and published posts are public.	Contract	Until you delete them or your account.
Protection and incident services (CryptoDam): plans, incidents, evidence, recovery steps and payouts	Plan and enrolment status and dates; wallet addresses and transaction hashes you give us; incident descriptions; evidence files; recovery notes and freeze instructions; payout records; your organisation and role.	Contract; legitimate interest for resolving disputes and legal claims	While your account exists, and up to 5 years after the incident is closed or the plan ends. Then deleted.
Questions and requests: contact, partnership, newsletter-interest and privacy requests; Genesis access requests	Name, email address, company, role, inquiry type and message. For Genesis also intended use, product interest, expected users, budget range and timeline.	Steps you ask us to take before a contract; legitimate interest in replying to you	3 years after our last contact with you. Then deleted.
Business partners and API users	API key records (kept as a hash), the IP address that last used each key, API request logs, webhook addresses and delivery records.	Contract with the business customer; legitimate interest for security	While the partner account is active and 1 year after it ends.
AI assistant with your own AI provider key	The messages you send and the app records the assistant needs to answer; your provider API key (stored encrypted with AES-256-GCM).	Contract (a feature you turn on)	Conversations are kept in your browser, not on our servers, and removed when you sign out. Your key is kept until you remove it or delete your account.
Connecting ChatGPT, Claude or another AI assistant to your account (the AI connector)	The connection: which assistant, the permissions you approved, when you approved it and when it was last used; one-way hashes of its access and refresh tokens (never the tokens themselves). What the assistant reads with your permission: CryptoDam reference information, and with “watchlist and alerts” your Hailey watchlist and alerts. We do not keep your conversations with the assistant or the requests it sends.	Consent (you approve each connection on our consent screen)	Until you disconnect, the connection ends, or you delete your account. Requests, codes and tokens are deleted a day after they can no longer be used; a replaced refresh token is kept until it would have expired (30 days) so its reuse can be detected. Approvals, denials and disconnections stay in the security and audit records.
Security and audit records	User ID, the action taken, the time, and before-and-after values of records you change.	Legitimate interest; legal obligations	Up to 5 years. Then deleted.
Optional analytics: how the site is used and how fast pages load	Page address (with sign-in data removed), referrer, browser, operating system, device type, approximate location (country, region and city), network speed and page-speed measurements.	Consent (“Accept analytics”)	Collected only after you accept. Vercel stores these measurements without linking them to you (section 7).

We do not intentionally collect resident registration numbers or other unique identification numbers, or sensitive information such as health data or political opinions. Please leave them out of messages and evidence unless your case needs them.

If you do not give us information needed for a service, we cannot provide that service. Analytics are always optional.

2. How long we keep information and how we delete it

We keep personal information only for the periods in section 1. When a period ends or its purpose is achieved, we delete the information without undue delay.

If a law requires us to keep information longer, or we need it for an ongoing dispute or legal claim, we keep only what is needed, limit access to the operator, and delete it when the need ends.

Electronic records are deleted from our database and file storage so they cannot be restored through the Services. Backups held by our hosting provider expire on that provider’s schedule. We do not keep paper records; anything printed is shredded.

4. Service providers who process information for us

Provider: Supabase, Inc.
What they do for us: Database, sign-in, file storage and server functions. Our database is stored in the Seoul (Korea) region.

Provider: Vercel Inc.
What they do for us: Website hosting and delivery. With your consent: Vercel Web Analytics and Vercel Speed Insights.

Provider: Google LLC
What they do for us: With your consent: Google Tag Manager. It is currently configured with no tags.

Provider: OpenAI OpCo, LLC
What they do for us: Drafting an assessment of Genesis access requests, and draft replies. A person reviews every draft before any decision or message.

Service providers
Provider	What they do for us
Supabase, Inc.	Database, sign-in, file storage and server functions. Our database is stored in the Seoul (Korea) region.
Vercel Inc.	Website hosting and delivery. With your consent: Vercel Web Analytics and Vercel Speed Insights.
Google LLC	With your consent: Google Tag Manager. It is currently configured with no tags.
OpenAI OpCo, LLC	Drafting an assessment of Genesis access requests, and draft replies. A person reviews every draft before any decision or message.

Providers may use the information only to provide their service to us, under their data processing terms. We will update this policy before we add a provider.

5. Transfers outside Korea

Some providers process information outside Korea. Under PIPA Article 28-8(1)(3) we transfer information needed to provide the Services under our contract with you by disclosing the details below. For optional analytics we rely on your consent.

For people in the EEA and UK: our database is stored in Korea, which the European Commission and the UK have recognised as providing adequate protection. Transfers to the United States rely on the providers’ data processing terms, which include the European Commission’s Standard Contractual Clauses.

Recipient and contact: Supabase, Inc. (privacy@supabase.com)
Country: Stored in Korea; may be accessed from the United States and other countries where Supabase and its sub-processors operate
Information: Information in section 1 that is stored in our database or file storage
When and how: Whenever you use the Services; encrypted network transmission
Purpose: Hosting, sign-in and support
How long the recipient keeps it: The periods in section 1

Recipient and contact: Vercel Inc. (privacy@vercel.com)
Country: United States and Vercel’s global delivery network
Information: IP address, browser and device information, pages requested; the analytics items in section 1 only with consent
When and how: Each time you visit; encrypted network transmission
Purpose: Website hosting and delivery; optional analytics
How long the recipient keeps it: Request logs for Vercel’s short log period; analytics stored without linking them to you

Recipient and contact: Google LLC (contact options at policies.google.com/privacy)
Country: United States
Information: IP address, browser information, page address
When and how: When a page loads after you accept analytics; encrypted network transmission
Purpose: Google Tag Manager (no tags configured)
How long the recipient keeps it: Under Google’s retention rules

Recipient and contact: OpenAI OpCo, LLC (dsar@openai.com)
Country: United States
Information: Genesis request fields: name, email address, organisation, role, intended use, product interest, expected users, budget range, timeline and message
When and how: When we run the assessment on a submitted request; encrypted connection
Purpose: Drafting the assessment and a reply for human review
How long the recipient keeps it: Up to 30 days for abuse monitoring; not used to train OpenAI’s models

Overseas transfers
Recipient and contact	Country	Information	When and how	Purpose	How long the recipient keeps it
Supabase, Inc. (privacy@supabase.com)	Stored in Korea; may be accessed from the United States and other countries where Supabase and its sub-processors operate	Information in section 1 that is stored in our database or file storage	Whenever you use the Services; encrypted network transmission	Hosting, sign-in and support	The periods in section 1
Vercel Inc. (privacy@vercel.com)	United States and Vercel’s global delivery network	IP address, browser and device information, pages requested; the analytics items in section 1 only with consent	Each time you visit; encrypted network transmission	Website hosting and delivery; optional analytics	Request logs for Vercel’s short log period; analytics stored without linking them to you
Google LLC (contact options at policies.google.com/privacy)	United States	IP address, browser information, page address	When a page loads after you accept analytics; encrypted network transmission	Google Tag Manager (no tags configured)	Under Google’s retention rules
OpenAI OpCo, LLC (dsar@openai.com)	United States	Genesis request fields: name, email address, organisation, role, intended use, product interest, expected users, budget range, timeline and message	When we run the assessment on a submitted request; encrypted connection	Drafting the assessment and a reply for human review	Up to 30 days for abuse monitoring; not used to train OpenAI’s models

How to refuse: you can refuse the transfers needed for the Services only by not using them or deleting your account, because the Services cannot run without these providers. You can refuse analytics at any time under “Privacy choices”. To have a Genesis request reviewed without the AI step, say so in your request or email us.

AI assistants you connect are not our service providers: when you approve a connection, the information it reads goes to the assistant's company in the United States (OpenAI OpCo, LLC for ChatGPT, Anthropic, PBC for Claude) under your consent on the consent screen, which shows the recipient, country, information, timing and method, purpose and retention (PIPA Article 28-8(1)(1)). Refusing or disconnecting only stops that assistant from reading it.

6. How we protect information

Access: administrative functions are limited to accounts with an administrator role. Database rules limit each record to the people allowed to see it, and roles in the app limit what each user can open.
Encryption: connections use HTTPS (TLS). Passwords are kept only as one-way hashes. AI provider keys are encrypted with AES-256-GCM, and partner API keys are kept as hashes. Our database provider encrypts stored data.
Extra sign-in check: if you turn on multi-factor authentication, protection records can only be opened in a session that has passed it.
Records: important actions are written to an audit log. Webhook error logs are filtered to remove personal and secret values.
Facilities: our data is held in our providers’ data centres, which control physical access.

7. Cookies, browser storage and analytics

We do not use advertising cookies or collect behavioural information for targeted advertising.

Always on, because the Services need them: your sign-in session, your language, and your privacy choice, kept in your browser’s storage. While you are signed in, your assistant conversations, unpublished drafts and recent searches are also kept on your device so you can resume them; they are removed when you sign out.

Only after you choose “Accept analytics”:

Vercel Web Analytics: page views without cookies. A visit is recognised by a hash of the request that is discarded after 24 hours.
Vercel Speed Insights: page-speed measurements that are not linked to you.
Google Tag Manager: currently configured with no tags. When it loads, Google receives your IP address and browser information.

How to refuse: use “Privacy choices” at the bottom of every page. You can also block or delete site data in your browser: Chrome: Settings > Privacy and security > Site settings. Edge: Settings > Cookies and site permissions. Safari: Settings > Privacy. Firefox: Settings > Privacy & Security. Blocking all storage for this site stops sign-in from working.

8. Your rights and how to use them

You can ask to see your personal information, correct it, delete it or stop its processing, and you can withdraw consent at any time. If you are in the EEA or UK, you can also ask us to restrict processing, object to processing based on legitimate interest, and receive the information you gave us in a portable format.

Email stuporeinvestment.kj@gmail.com from the address on your account, or tell us how we can confirm it is you. You can also use the Contact page and choose “Legal / Privacy”.
In the app you can edit your profile and remove your profile picture. Signing out removes your assistant conversations, drafts and recent searches from your device.
Someone acting for you, such as a legal representative or a person you authorise, can make a request with proof of authority (for example a power of attorney).
We reply within 10 days of receiving your request. If we refuse or limit a request because a law allows or requires it, we tell you why and how to object.
Requests are free. Withdrawing consent does not affect processing that happened before.

9. Children

The Services are for people aged 14 and over. We do not knowingly collect personal information from children under 14. If we learn that we have, we delete it. A parent or guardian who believes a child under 14 has given us information can contact us.

10. Automated decisions and AI

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. For Genesis access requests an AI service may draft an assessment, but a person makes every decision and reviews every message before it is sent. We do not use your personal information to train AI models.

11. Privacy officer

Privacy officer: KYUNG JIN KIM, the operator of Stupore Investment. Email: stuporeinvestment.kj@gmail.com. Questions, complaints and requests about personal information are handled at this address.

12. Where else to get help

In Korea you can contact:

Personal Information Dispute Mediation Committee: www.kopico.go.kr, 1833-6972
Personal Information Infringement Report Center (KISA): privacy.kisa.or.kr, 118
Supreme Prosecutors’ Office: www.spo.go.kr, 1301
Korean National Police Agency: ecrm.police.go.kr, 182

In the EEA you can complain to the data protection authority where you live or work (list at edpb.europa.eu). In the UK you can complain to the Information Commissioner’s Office (ico.org.uk).

13. Changes to this policy

We post every new version on this page with its effective date. If a change adds purposes, information, providers or transfers, or reduces your rights, we announce it on the site at least 7 days before it takes effect and ask for consent where the law requires it.

Version effective 25 October 2026 (posted 18 October 2026): adds connecting ChatGPT, Claude or another AI assistant to your account (sections 1, 3 and 5). Connections open to every member on that date.