KorMarathon External Processing and Overseas Transfer Notice
This notice forms part of the KorMarathon Privacy Policy. Unless otherwise specified, countries in parentheses are countries of establishment, distinct from personal-information processing locations.
| Provider and contact | Service used |
|---|---|
| Supabase Pte. Ltd. (Singapore) · privacy@supabase.io | Member authentication and storage |
| Vercel Inc. (United States) · privacy@vercel.com | Web delivery, traffic and performance analytics |
| Plus Five Five, Inc. — Resend (United States) · privacy@resend.com | Account/service emails and consented promotional emails |
| Cloudinary (U.S. headquarters) · Cloudinary Ltd. · privacy@cloudinary.com | Event-image storage and delivery |
| Google LLC (United States) · Google Asia Pacific Pte. Ltd. (Singapore) · privacy inquiries | Google sign-in, Analytics, AdSense and inquiry-email processing |
| Microsoft Corporation (United States) · privacy inquiries | Clarity analytics, advertising and service improvement |
| Ahrefs Pte. Ltd. (Singapore) · privacy@ahrefs.com | Traffic statistics and Google Analytics imports |
| Hostinger International Ltd. (Cyprus) · gdpr@hostinger.com | Sending, receiving and storing inquiry and promotion/sponsorship emails |
Personal-information processing and overseas transfers
Purposes and information categories are described in Sections 1, 5 and 6 of the Privacy Policy and below. KorMarathon's retention criteria follow Section 3. Providers' separate retention/deletion criteria are as follows.
| Activity | Information and processing locations | Retention/deletion criteria |
|---|---|---|
| Supabase authentication/storage | Member, posting, request and activity data · Primary storage: Korea | Section 3 criteria. Copies deleted after the 30-day return period following provider-agreement expiry |
| Vercel web delivery/analytics | Access, device, error and usage statistics · Primary web service: Korea / provider's primary facilities: United States | Entrusted data: service deletion functions or deletion within a commercially reasonable period after agreement termination. Separate operational data: minimum period needed for operations, security and legal obligations, then deletion/anonymization |
| Resend email delivery | Email, message, delivery, open, click and subscription information · Japan/United States | Email/delivery records: 30 days; backup copies: seven days. Contact lists: Section 3. Remaining customer data deleted within 90 days after provider-account termination |
| Cloudinary image delivery | Personal information in images and access data · Originals: United States | Images: deletion functions or subscription termination; delivery copies may remain up to 30 days after deletion/replacement. Access data: period needed for purposes/legal requirements, then reasonable deletion/de-identification |
| Google sign-in/analytics/advertising | Account identifiers/emails received through sign-in; access, device and activity information and identifiers such as cookies | Received member information: Section 3. Analytics user/event data: 14 months (new activity may renew user retention; standard aggregates excluded). Entrusted measurement data: deletion from the provider's systems within 180 days after irrecoverable deletion in the service or agreement termination, except statutory retention. Own-purpose data: need-based retention and deletion/anonymization criteria determined by purpose, nature and legal obligations |
| Microsoft Clarity | Screen, click, device, access information and identifiers · United States | Ordinary playback: 30 days; marked/sample recordings and click/heatmap data: up to nine months, then deletion |
| Ahrefs traffic statistics/imports | Traffic statistics and imported Analytics data · Information constituting personal information: United States | Deletion when unnecessary for collection purposes or deleted within the service. Legal/security retention limited to the necessary period. Basic traffic statistics use no cookies/persistent identifiers |
| Hostinger/Google inquiry emails | Sender/recipient emails, content, attachments and transmission information | Section 3. Deleted emails in each service's trash are permanently deleted within 30 days and may be deleted earlier |
Timing/method: Processing occurs over networks when relevant features are used, data are stored/delivered, or emails are sent/received.
Transfer basis: Article 28-8(1)(3) of Korea's Personal Information Protection Act applies to overseas entrusted processing/storage necessary to perform the service contract with the user. This is distinguished from Google's and Microsoft's independent advertising/product-improvement use. Separate prior consent is obtained for processing that legally requires it.
Refusal/effects: To refuse overseas processing, send the relevant activity and request details to contact@kormarathon.com. Requests are handled under applicable law after necessary checks. Refusing processing necessary for authentication, storage, web delivery or email sending may restrict the relevant feature. Analytics/advertising controls are described in Section 6 of the Privacy Policy.
Subprocessors and tasks are also described in the relevant service notices from Supabase, Vercel, Resend, Cloudinary, Google Analytics, and Ahrefs.