Privacy Policy

1. Scope and Controller

REFLO ("REFLO," "we," "us," or "our") operates the REFLO desktop application, REFLO History (the Mac App Store version), Account Hub website at https://reflo.io.kr, Cloud History API, and related services (collectively, the "Services").

For purposes of the EU General Data Protection Regulation (GDPR), UK GDPR, and similar laws, REFLO is the data controller for personal information described in this policy unless we state otherwise for organization/team features processed on behalf of a customer.

Official website: https://reflo.io.kr · Contact: privacy@reflo.app (privacy) · support@reflo.app (support)

2. Information We Collect

We collect the following categories of information. What applies to you depends on which REFLO products and features you use (see Section 16 for REFLO History, the Mac App Store version):

• Account and profile data: name, email address, password hash, organization/team membership (web and desktop accounts only), and account preferences.
• Billing data: For web and REFLO desktop subscriptions, subscription status, plan identifiers, and payment-related metadata processed by Paddle (we do not store full payment card numbers). For REFLO History on the Mac App Store, Apple processes In-App Purchase subscriptions; we receive subscription status, product identifiers, and account identifiers needed to unlock Pro and Cloud History (see Section 16).
• Usage and device data: app version, operating system, diagnostic logs, and feature usage needed to operate and secure the Services. REFLO History on the Mac App Store does not send usage, analytics, device-identifier, or crash telemetry to us at all (see Section 16).
• Cloud History and sync data (REFLO desktop add-on): file metadata, version history, storage usage, connection tokens, and encrypted or chunked content you choose to store in Cloud History. Client share preview images and link metadata are stored in our cloud infrastructure only when you explicitly create a client share link (Section 16).
• Communications: support requests, email delivery events (magic links, invites), and operational notices.
• Website data: cookies or similar technologies on the Account Hub for authentication sessions and security (see Section 9).

3. Sources of Information

We collect information directly from you, automatically when you use the Services, from your organization administrator (for team accounts on web or desktop), and from service providers such as payment processors (Paddle, Apple), and infrastructure hosts.

4. How We Use Information

We use personal information to:

• Provide, maintain, and improve the Services (including local and cloud backups, versioning, search, and sync where enabled).
• Authenticate users and manage accounts, entitlements, and organization access.
• Process subscriptions and billing: Paddle for web and REFLO desktop plans; Apple In-App Purchase for REFLO History on the Mac App Store.
• Send transactional messages (sign-in links, security alerts, billing notices).
• Monitor performance, debug issues, prevent fraud and abuse, and comply with law.
• With your consent or as permitted by law, send product updates or marketing (you may opt out).

5. Legal Bases (GDPR / UK GDPR)

Where GDPR or UK GDPR applies, we rely on: (a) performance of a contract (providing the Services you request); (b) legitimate interests (security, product improvement, fraud prevention, internal analytics balanced against your rights); (c) consent (where required, e.g., optional marketing); and (d) legal obligation (tax, accounting, regulatory requests).

6. How We Share Information

We do not sell your personal information as defined by the California Consumer Privacy Act (CCPA/CPRA). We do not share personal information for cross-context behavioral advertising.

We share information with service providers under contracts that limit their use to providing services to us, such as cloud hosting and database providers, our payment processors (Paddle for web/desktop billing; Apple for Mac App Store In-App Purchases), email delivery providers, and analytics or error reporting tools where enabled on applicable products.

Some optional REFLO desktop features send change metadata to a third-party AI provider to generate a written summary. Those features are off by default, require a paid plan, are not available in REFLO History on the Mac App Store, and never send your document contents or file paths.

7. International Transfers

We may process and store information in countries other than your own. Where required, we use appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms for transfers from the EEA, UK, or Switzerland.

8. Data Retention

We retain personal information for as long as your account is active or as needed to provide the Services, resolve disputes, enforce agreements, and comply with legal obligations.

Cloud History content and Client share previews are retained according to your plan, share link expiry, storage policies, and deletion requests. Local version history in REFLO History remains on your Mac until you delete it in the app or uninstall the app; it is never sent to us. Backups may persist for a limited period after deletion for disaster recovery.

9. Cookies and Similar Technologies

The Account Hub uses essential cookies (or equivalent local storage) for authentication sessions and security. We do not use non-essential advertising cookies on the Account Hub.

You can control cookies through your browser settings; disabling essential cookies may prevent sign-in.

10. Security

We implement technical and organizational measures designed to protect personal information, including encryption in transit, access controls, and monitoring. No method of transmission or storage is 100% secure.

11. Your Privacy Rights

Depending on your location, you may have the right to access, correct, delete, restrict, or object to processing of your personal information, and to data portability.

EEA/UK residents may lodge a complaint with your local supervisory authority.

California residents (CCPA/CPRA) have the right to know categories of data collected, request deletion, correct inaccurate data, and opt out of sale/sharing (we do not sell personal information). You will not be discriminated against for exercising these rights.

To exercise rights, email privacy@reflo.app with enough information to verify your account. We respond within timelines required by applicable law.

12. Children's Privacy (COPPA)

The Services are not intended for children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected such information without verifiable parental consent, we will delete it promptly.

13. Automated Decision-Making

We do not make decisions based solely on automated processing that produce legal or similarly significant effects without human review, except for security and anti-abuse measures (e.g., blocking suspicious sign-in attempts).

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised policy with an updated effective date and provide additional notice where required by law.

15. Contact Us

Privacy inquiries and data subject requests: privacy@reflo.app

General support: support@reflo.app

Official website: https://reflo.io.kr

16. REFLO History (Mac App Store)

This section applies if you use REFLO History, the macOS app distributed on the Mac App Store ("REFLO History"). If this section conflicts with the general descriptions above, this section controls for REFLO History.

Local version history works entirely on your Mac and does not require an account. We do not receive your files, file names, folder paths, or version history unless you turn on Cloud History after purchasing that add-on.

• Local version history: save versions are stored on your Mac, in the app's App Group container or in a folder you pick yourself. They are never uploaded to REFLO servers unless you enable Cloud History.
• Optional account: you may sign in to link In-App Purchases and, if you buy Cloud History, to connect cloud storage. Sign-in uses the system authentication sheet. We then process your email address and account identifiers for app functionality (authentication, entitlements, support). You can delete the account from Settings → Account.
• In-App Purchase: REFLO History sells REFLO Pro and Cloud History capacity (100 GB / 300 GB / 1 TB) as auto-renewing subscriptions through Apple In-App Purchase. Apple processes payment. If you already bought the same digital features on our website, the app may unlock them (Guideline 3.1.3(b)) while the same items remain available as In-App Purchases.
• No analytics or telemetry: REFLO History does not send usage data, feature-usage events, device identifiers, advertising identifiers, or crash reports to us, and it contains no third-party analytics or advertising SDKs. NSPrivacyTracking is disabled and there are no tracking domains.
• Folder access: REFLO History is sandboxed and reads or writes only the folders you explicitly choose. Automation permission, if you grant it, is used solely to reveal a folder you selected in Finder.

17. Republic of Korea (PIPA)

For users in the Republic of Korea, additional information required under the Personal Information Protection Act (PIPA) is provided in the Korean version of this Privacy Policy (switch site language to Korean on this page).

Privacy officer contact: privacy@reflo.app · Official website: https://reflo.io.kr

This English version is provided for global users. It is not legal advice.