Privacy Policy

ABZ Inc. ("ritchi", "we") processes personal data to provide ritchi address and creator collaboration services. Mandatory privacy laws applicable in Korea and other relevant jurisdictions apply in addition to this notice.

Category

Examples

Account & profile

Name, email, login information, creator profile

ritchi address

Message content, headers, sender/recipient addresses, attachments, mail status

Collaboration & deal

Brand, campaign objective, requested deliverables, budget/price range, timing, negotiation/deal stage, outcome

Usage

Feature usage, logs, device/security information, settings, More Opportunities ON/OFF

AI-related

Inputs used for summarization/classification/recommendations, generated outputs, feedback

Non-user senders

Name, business contact details, affiliation, message, attachments and collaboration information of people emailing @ritchi.me

When location features are offered, optional location for members who turn them on: approximately 5km coordinates and city/country names. Resident registration numbers and precise coordinates are not collected by our server.

Deliver, store and search email; operate accounts

Summarization, classification, reply drafting, scheduling, collaboration and deal management

When More Opportunities is enabled, handle brand inquiries, support collaboration and connect opportunities

Security, spam/fraud/abuse prevention and dispute handling

Service improvement, statistics/research, matching, pricing, transaction and AI/Intelligence development

Compliance with legal obligations and protection of rights

Product news, event and promotion emails require separate optional consent, withdrawable at any time in Me. This is independent of service notification and push consent.

ritchi may structure information such as brand/industry, campaign objective, requested content, budget or price range, timing, deal stage, response, negotiation and outcome. Where practicable, general analytics and Intelligence use structured, pseudonymized or aggregated information rather than identifiable raw content.

More Opportunities and related automated replies are optional features not yet available; the following applies only when offered and separately enabled.

When a creator enables More Opportunities, ritchi may further process relevant data to actively manage brand collaborations and connect new opportunities at the creator's request, including acknowledgements, information requests, scheduling, term confirmation, deal progress and relevant service connections. The feature may be disabled at any time.

More Opportunities and related automated replies are optional features not yet available; the following applies only when offered and separately enabled.

If you email an @ritchi.me address, ritchi may process your name, business contact details, affiliation, message, attachments and collaboration information to deliver the message and support the creator's collaboration workflow. If the creator enabled More Opportunities, ritchi may communicate on the creator's behalf regarding acknowledgement, additional information, scheduling, terms and deal progress.

Separate ritchi/Winnery promotions or recurring sales and marketing communications are handled with the consent, notice or opt-out procedures required by applicable law.

Where a legal basis is required, processing may rely on performance of a contract or steps requested by the user, legal obligations, legitimate interests such as security, fraud prevention and service improvement, and consent where required. Direct marketing is also subject to applicable electronic-communications and marketing rules.

The operational details below disclose actual processors and transfers, including data, purposes, countries, recipients, retention and refusal methods. We use AWS Seoul infrastructure (PostgreSQL and S3), Amazon SES, Twilio Verify, Cloudflare Turnstile, Google Workspace, Anthropic Claude API, Expo and Apple APNs/Google FCM. First-party analytics and screen recordings are stored in AWS Seoul.

Amazon Web Services, Inc. · infrastructure, storage and SES

Seoul, Republic of Korea. Account data, mail content, headers, attachments and metadata, usage and screen recordings. Hosting, mail delivery, security and first-party analytics. Account/mail until account deletion; ingress raw mail up to 7 days; usage 365 days (unlinked 30 days); screen recordings 30 days.

Twilio Inc. · Verify

United States. Phone number and verification/delivery data, transferred over HTTPS when requesting verification. Verification purpose up to 10 minutes; delivery records under provider policy. Refusal restricts sign-up/login. Contact and transfer details appear in the operational tables.

Cloudflare, Inc. · Turnstile

United States, EEA and other provider operating countries. IP, browser/device signals and site address over HTTPS for bot protection during verification requests. Entrusted purpose ends at verification; independent bot-detection improvement follows provider policy. See operational tables for contact and refusal.

Anthropic, PBC · Claude API

US storage; computation may occur in other countries selected by the provider. Consented mail, chats, memories and work context over HTTPS. Deletion within 30 days; exceptions for policy violations up to 2 years, safety scores up to 7 years and legal duties. No model training. Exact fields and withdrawal are in the operational tables.

650 Industries, Inc. · Expo / Apple APNs / Google FCM

Expo: United States. Push tokens, installation ID, notification title/body and destination over HTTPS on registration/delivery. Expo retains notification content until forwarding to Apple/Google and tokens under its policy. APNs/FCM countries and retention follow provider policies. Refusal and logout are described below.

Google LLC · Workspace

Support messages, attachments and contact details for receiving and replying to inquiries. Processing occurs on receipt/reply, until contract termination or resolution. Countries and provider retention follow the Workspace contract/policies. Contact support@ritchi.me.

Apify Technologies s.r.o. · optional public Instagram lookup processor

We entrust public-profile lookup for previewing and confirming your own account, saving your account settings, and looking up other accounts or brand collaboration references requested in chat. At lookup time, a public Instagram username or brand account URL is sent to Apify over HTTPS. We process public names, biographies, follower and other statistics, recent post types, times, views, likes, comments and short captions, and the authors and paid partnership indicators of posts tagging a brand. Profile-picture and thumbnail URLs are used only in the preview response and are not saved in our storage. Calls occur only when lookup is enabled; no lookup means no transfer abroad. Under the DPA, destinations are the US and countries where the provider or its subprocessors operate. Our other-account and brand lookup caches are valid for 24 hours and are deleted by cleanup after expiry. Own-account previews can be confirmed for 15 minutes and are used again for same-day lookups; cleanup deletes rows more than 2 days after creation. Confirmed own-profile values are retained until account deletion and updated when a new lookup is saved. Provider run/dataset retention follows the contracted plan. Contact privacy@apify.com.

Apple · WeatherKit / Korea Environment Corporation · AirKorea

When location features are offered, weather queries for members who turn them on send approximately 5km coordinates, time zone and country where available over HTTPS to WeatherKit, without member identifiers. Apple states location is used only for forecasts and is not tracked between requests. Processing countries and exact provider retention follow Apple contracts/policies. AirKorea (Republic of Korea) receives only public region/station queries. Turning Location off in Me stops future approximate-location queries.

Personal data may be transferred internationally. Where required, ritchi uses appropriate transfer mechanisms such as SCCs, adequacy decisions, contractual safeguards, a lawful basis under Korean privacy law or consent, and provides required notices.

For transfers necessary to perform the contract, the disclosure/notice requirements of Article 28-8(1)(3) of the Korean Personal Information Protection Act apply; processing requiring separate consent is transferred only after that consent.

Some mail and collaboration data may be processed by AI systems for summarization, classification, reply drafting, matching, pricing and negotiation support. ritchi configures retention and use of data again consistent with actual provider settings and contracts and discloses model-training use where relevant. Where legally significant solely automated decisions are introduced, required controls, explanations and challenge mechanisms will be provided.

Actual AI transfers, purposes, no-training terms, retention exceptions and individual AI consent follow the Anthropic table in the operational details. Reading this policy does not grant individual AI consent.

Account, mail content, attachments, summaries, collaboration information, conversations, memories and moods are kept until account deletion. Ingress raw mail is kept for up to 7 days; member usage events for 365 days; unlinked pre-signup events for 30 days; screen recordings for 30 days; push tokens until logout on that device or account deletion. Full birth dates are not stored after age verification; only the verification time and birth month/day are kept. Deleted handles cannot be use of data againd to prevent misdelivery. Separate file deletion is retried until completion is confirmed. Retention required for future transaction features will be disclosed when introduced.

Subject to applicable law, individuals may have rights to access, correct, delete, restrict or stop processing, withdraw consent, portability, object to direct marketing and exercise rights concerning automated decisions. Where applicable, U.S. state privacy rights such as access, deletion, correction and opt-out are also supported.

The minimum age is 19. Age is checked using the birth date; users under 19 cannot register.

Operator: ABZ Inc. Representative: Harim Choi. Business registration: 125-87-01240. Address: 16F, DREAM PLUS Gangnam, 311 Gangnam-daero, Seocho-gu, Seoul, Republic of Korea. Legal and privacy contact: support@ritchi.me. Privacy officer: Harim Choi (CEO).

When location features are offered, this section applies only to members who turn them on. Location is optional and is used only after you allow approximate location while using the app in the OS permission prompt. The device rounds coordinates to approximately 5km and sends only those approximate coordinates, measurement time and the OS-provided city and country display name to our server for local weather and scheduling guidance. Precise coordinates never leave the device. We do not collect background location or route history.

Approximate coordinates, time zone and country where available are sent to Apple WeatherKit for weather requests. OS location and city/country lookup also follow the OS provider policies. For Korean air quality, AirKorea regional and monitoring-station information is used. Location is not provided for advertising or tracking. Other services remain available if you decline.

Turn off Location in Me to stop future use and delete the current location stored on our server. OS settings also let you revoke permission. Contact support@ritchi.me to withdraw all or part of your consent, temporarily suspend use, inspect or receive notice of your use/provision records, or correct errors. We do not refuse without a legitimate reason. Locations you wrote in past conversations follow the conversation retention and deletion policy.

When location features are offered, we will ensure that use/provision confirmation records are automatically recorded and retained under Article 16(2) of the Korean Location Information Act, and destroyed after the retention period required by applicable law. The applicable retention period and handling procedures will be disclosed when the features are offered. On withdrawal, personal location information and confirmation records are promptly destroyed except where retention is legally required. Current approximate location is kept until you turn the feature off or delete your account.

You may claim damages for violations under Article 27; the company is liable unless it proves absence of intent or negligence. General liability caps do not restrict mandatory location-information rights. Unresolved disputes may be referred to the adjudication or mediation procedures under Article 28, the Personal Information Dispute Mediation Committee, or the competent court.

Questions about the location information manager and location complaints are received through our privacy officer Harim Choi (CEO), at the address and email in the contact section. As users under 19 cannot register, we do not offer location services based on guardian consent for children or protected persons.

When you sign up

Name, date of birth, phone number, and the email address (username) you choose

While you use the service

The subject, body, attachments and sender of email received at your address; replies you send; events, offer details and Instagram figures you enter (followers, reel views, saves)

When you talk with ritchi

What you send ritchi and ask it, what ritchi remembers from your chats (a profile such as what to call you, what you like, people who matter and your neighborhood, and stories from work and life), and your mood as read from your chats

When you allow notifications in the app

The device's push token, its type (iOS · Android) and the app version

Collected automatically

Access logs, device and browser details, usage records

App usage records

Screen navigation, taps, input starts, scrolling, errors, response times and app state; acquisition source (invite code and inviter, UTM labels, referrer domain and store); optional signup source and satisfaction responses

Screen recordings

The structure and changes of app screens, including visible text, email bodies, chats with ritchi entered content and console output. Input values in console output are masked. Date-of-birth and verification-code fields are masked on the device and are not sent.

Device identifier

A random value generated by the app, linked to your account when you log in. First acquisition source and optional responses are account attributes retained until account deletion.

We do not collect resident registration numbers. Optional location follows the location section above. Instagram figures include your own input and optional public-profile lookup results.

Required

Verifying your identity and logging you in (including a human check against automated requests when you ask for a login code), issuing your email address and receiving mail

Required

Reading received mail to extract offer details and to make summaries, going-rate checks and reply drafts

Optional

ritchi's AI features (if you agree to the AI processing): answering chats and email questions, polishing reply drafts automatically or on request, sorting offer details from received mail, summarizing chats and organizing memory for later answers and what ritchi says when it reaches out

Service improvement

Collecting usage records and screen recordings to improve the service, find errors and produce usage statistics

Optional

Sending notifications for new mail, replies and deadlines, and when ritchi reaches out (push notifications included)

You can sign up without agreeing to the optional items, and receiving mail, summaries, going rates and replies all work the same. Under Article 15(3) of the Personal Information Protection Act and Article 14-2 of its Enforcement Decree, we may use personal information without additional consent within a scope reasonably related to its original purpose. We consider the connection to that purpose, predictability in light of collection circumstances and processing practices, unfair harm to your interests, and safeguards such as pseudonymization or encryption. For other added purposes, we will ask for your consent separately.

Account details

Until you delete your account

Mail body, attachments, summaries

Until you delete your accountRaw files for receiving: up to 7 days

Chats with ritchi, what it remembers and your mood as read from your chats

Until you delete your account

Push tokens

Until you log out on that device or delete your account

App usage records

1 year from recording; pre-signup records expire after 30 days unless linked to an account

Screen recordings

30 days from recording

Login and access logs

3 monthsBasis: Protection of Communications Secrets Act

When the period ends or the purpose is met, we destroy the information without delay. As the service is free, there is no duty to keep transaction records.

We do not provide personal information to third parties without a lawful basis or separate consent. External location processing is described above.

The only exceptions are when you agree separately or a law specifically provides for it.

To provide the service, the company entrusts the processing of personal information as follows. Processors may not use it for anything beyond the work entrusted to them (the exception Cloudflare has published is set out below the table).

Servers and storage

Amazon Web Services, Inc. (AWS) · runs the infrastructure and stores data and analytics records (usage records in PostgreSQL and screen recordings in S3) in the Seoul regionKept until the contract ends or you delete your account

Text messages

Twilio Inc. (Twilio Verify) · sends login codes by text and checks the code you enterKept until verification is complete (up to 10 minutes after the request). After that, Twilio keeps only the delivery record for its own retention period.

Stopping automated requests

Cloudflare, Inc. (Turnstile) · checks that a login code request comes from a personKept until the check is done. What Cloudflare uses to improve its own bot detection is set out below the table.

Receiving and sending mail

Amazon Web Services, Inc. (AWS SES) · receives mail sent to your address and sends repliesKept until the contract ends or you delete your account

Support mailbox

Google LLC (Google Workspace) · receives and answers inquiries to support@ritchi.meKept until the contract ends or the inquiry is closed

AI features

Anthropic, PBC (Claude API) · answers chats and email questions, polishes reply drafts automatically or on request, sorts offer details from received mail, summarizes chats and organizes memory, and writes what ritchi says when it reaches outDeleted within 30 days of receipt (up to 2 years for content flagged under its usage policy; safety classification scores for up to 7 years). Data may be retained longer if required by law. What it receives is not used to train AI.

Push notifications

650 Industries, Inc. (Expo) · registers the push token of a device that allowed notifications in the app and passes notifications on to Apple's and Google's push notification servicesNotification contents only until passed to Apple's and Google's push notification services (never stored in a database); push tokens under the processor's own retention

Cloudflare has published that it also uses the signals from the human check (the IP address you connect from and browser and device details) to improve its own bot detection. That part is a purpose Cloudflare sets for itself, not work we entrust, and Cloudflare keeps that data under its own retention.

If the work entrusted or the processors change, we publish it in this policy before the change.

Servers and storage are in Korea (Seoul). The personal information transferred abroad is what the tables below set out: your phone number when a login code is sent by text, the human check details when you request a login code, device details and notification contents for app notifications, and what ritchi's AI features use. If recipients are added or changed, we will update this policy before the change and notify you.

What is transferred

Phone number

Destination country

United States

When and how

When you request a login code, sent over an encrypted connection (HTTPS)

Recipient

Twilio Inc. · 101 Spear Street, San Francisco, CA, USA · privacy@twilio.com

Purpose and retention

Used only to send the code by text and check that it matches. The purpose ends once verification is complete (up to 10 minutes after the request), and Twilio keeps only the delivery record for its own retention period.

How to refuse

Tell us through our support channel and we will not transfer it. However, phone verification is how you log in, so if you refuse, you cannot log in or sign up.

What is transferred

The IP address you connect from, browser and device details (User-Agent, characteristics of the encrypted connection), and the address of the site that called the human check

Destination country

United States. Cloudflare stores data mainly in the United States and the European Economic Area and may access it from other countries where it operates.

When and how

When you request a login code, the human check widget on that screen sends it over an encrypted connection (HTTPS)

Recipient

Cloudflare, Inc. · 101 Townsend St., San Francisco, CA, USA · dpo@cloudflare.com

Purpose and retention

Used to stop automated requests (bots). The purpose we entrust ends once the check is done. Cloudflare has published that it also uses the same signals to improve its own bot detection; that part is a purpose Cloudflare sets for itself, and Cloudflare keeps the data under its own retention.

How to refuse

If you do not request a login code, nothing is transferred. However, the human check is a condition for sending the code, so if you refuse, you cannot log in or sign up.

What is transferred

The push token of a device that allowed notifications in the app (the one Apple or Google gave the device) and the app's installation ID; when a notification is sent, its title, body and the screen it opens

Destination country

United States

When and how

When you allow notifications in the app and when a notification is sent, over an encrypted connection (HTTPS)

Recipient

650 Industries, Inc. (Expo) · 624 University Ave FL1, Palo Alto, CA, USA · expo.dev/contact

Purpose and retention

Used only to deliver notifications to the device. Notification contents are kept only until passed to Apple's and Google's push notification services and never stored in a database. Expo keeps push tokens under its own retention.

How to refuse

Refuse when the app asks to allow notifications, and nothing is transferred. Once allowed, turning off ritchi notifications stops notification contents from being sent, and logging out on the device deletes its push token from our server. The service works the same without notifications.

What is transferred

What ritchi's AI features use: Received mail (sender name and email address, time received, subject, body and attachment file names), replies you have sent, chats and questions with ritchi, what ritchi remembers (moods and notes) and chat summaries, reply drafts you write or polish (including automatic polishing) and polishing instructions, your profile (name, rates, categories, conditions and Instagram statistics), ongoing offers, events, payments and your account's time zone. The phone number and verification codes from sign-up are never sent. What you write in chats and mail is sent as written; only numbers of 10 or more digits (such as account and card numbers) in the ritchi tab chat are masked. Phone-number formats and numbers separated by periods stay unmasked. Deleted memories are not sent.

Destination country

United States (Anthropic's storage). The computation that makes an answer may run in other countries Anthropic chooses.

When and how

After you agree to the AI processing: when you chat with ritchi or ask about mail, when reply drafts are polished automatically or on request, when offer details are sorted from mail received after consent, when chats and memory are summarized, and when ritchi reaches out first (at most once a day). Our server sends the data over an encrypted connection (HTTPS).

Recipient

Anthropic, PBC · 548 Market St, PMB 90375, San Francisco, CA, USA · privacy@anthropic.com

Purpose and retention

Used only to sort offer details from received mail, answer email questions, polish reply drafts, chat with ritchi and write what it says when it reaches out, summarize chats and organize memory. Anthropic deletes content within 30 days of receipt (up to 2 years for content flagged under its usage policy; safety classification scores for up to 7 years), unless law requires longer retention. It is not used to train AI. Under its contract with us, Anthropic protects personal information to at least the same level as this Privacy Policy.

How to refuse

If you do not agree to the AI processing, nothing is transferred to Anthropic. You can still use mail, the calendar and cards; only AI features are turned off. You can withdraw your consent at any time in Me > Settings > ritchi's AI, and nothing is transferred after that.

You can ask to see, correct or delete your personal information, or to stop its processing, at any time (Personal Information Protection Act, Article 35). Optional consents can be changed in Me > Settings, and you can delete your account right in the app.

To ask in writing, send the request form (Annex 8 of the Act's Enforcement Rule) to our support channel. Someone acting for you must also submit the power of attorney (Annex 11). You can also ask to see your information via the Personal Information Protection Commission's Personal Information Portal (privacy.go.kr).

People under 19 cannot sign up. We check the date of birth at sign-up and stop the sign-up there if you are under 19, so we never collect the personal information of children under 14.

When you delete your account, we revoke login access and delete the account, received mail bodies, summaries and going-rate checks, events, notifications, invites, chats with ritchi, what it remembers and your mood as read from your chats, push tokens, usage records and screen recordings from the service. We also request deletion of stored raw mail and attachments and confirm the result. If storage has an outage, file deletion may take longer.

A deleted email address (username) is blocked from being used again.

Otherwise mail meant for the previous owner would reach whoever took it next. Records needed to confirm that files were deleted may be kept for as long as that confirmation takes.

Connections to the service are encrypted, and login codes waiting to be sent are stored encrypted. Access is limited per account, so no one can see another member's mail or calendar.

Usage records and screen recordings are used to improve the service, find errors and produce usage statistics. Only one operations owner can view them, and access is logged. They are not used for advertising or tracking across apps.

Usage records and screen recordings are required items the app records and sends while you use it, for service improvement, finding errors and usage statistics. If you do not want this collection, you cannot use the service. Records already received remain for their retention period, and usage records and screen recordings are destroyed without delay on account deletion.

We use the cookies needed to keep you logged in and to check phone verification. We do not track you for advertising.

You can block cookies in your browser settings (Chrome: Settings > Privacy and security > Third-party cookies), but you will not stay logged in.

When this policy changes, we post the change and its effective date here first. It takes effect 7 days after posting; for important changes, such as what we collect or why, we announce them at least 30 days ahead.

This revision adds usage records, screen recordings and device identifiers.

View previous policy

2026-10-16: AI processing items, protection level and English version added (no change to the processing itself).

Privacy officer

Harim Choi (CEO)

Email

support@ritchi.me

Operator

ABZ Inc.

Representative

Harim Choi

Address

16F, DREAM PLUS Gangnam, 311 Gangnam-daero, Seocho-gu, Seoul, Republic of Korea

If you need to report an infringement of your personal information or get advice about one, you can contact these offices.

Personal Information Infringement Report Center

118 (no area code) · privacy.kisa.or.kr

Personal Information Dispute Mediation Committee

1833-6972 (no area code) · www.kopico.go.kr

Supreme Prosecutors' Office, Cyber Crime Unit

02-3480-3573 · www.spo.go.kr

Korean National Police Agency, Cyber Investigation Bureau

182 (no area code) · ecrm.police.go.kr