Privacy Policy

Effective date: 2026-11-01. The Korean version is the governing text.

This policy explains how Traffic R&D ("we") handles personal information in connection with Coganu AI.

1. Research data

Research data processed in the desktop software — structures, sequences, assay values, queries and results — is not sent off your PC and is not collected by us. The only exception is a reproduction input that you review and choose, item by item, to send so we can fix an error (section 2a). Web-demo inputs are not stored after the result is returned and are never used to train our models. This policy covers the information needed for accounts, licensing and payment confirmation.

2. What we process and why

2a. Diagnostics

• Web page errors are recorded automatically because the web demo holds no research data; research-data-like text is masked before recording. We never ask you for an error number.
• Desktop errors stay in a review list on your PC and are sent, as processed reports, only when you choose them or turn on automatic sending (asked once after installation; off by default). Reproduction inputs are never sent automatically.
• Reproduction inputs are stored encrypted and deleted once the fix is done (at most 30 days). You can request immediate deletion at any time by reference number in the app's Diagnostics and problem reports.
• GPU components for structure prediction are downloaded by your PC directly from the official PyTorch (download.pytorch.org), AMD (repo.radeon.com) and PyPI (files.pythonhosted.org) servers. Those servers receive your PC's connection data, never research data; they are not our processors and handle their logs under their own policies.

• We never receive or store card numbers or other payment-method details; payments are handled by the Merchant of Record (Paddle or Polar).
• Your IP address is recorded in our access log to limit excessive requests and to investigate abuse, and is deleted after 30 days (logs rotate daily and we keep 30 days). Security-event records keep only the first three octets (e.g. 203.0.113.0/24) for 180 days, so an individual is not identified. Research data (structures, sequences, assay values, queries and results) is never in the access log — that data does not leave your PC in the first place. Our hosting providers (section 4) may also process connection logs for security under their own policies.

3. Retention

We delete personal information without delay when you close your account or the purpose is fulfilled, except where Korean law requires retention: contract and withdrawal records (5 years), payment and supply records (5 years), consumer complaint and dispute records (3 years), and tax invoices (5 years). Sign-in codes expire after 10 minutes and sessions after at most 30 days. Diagnostics: access logs (including IP) 30 days, web page error records 30 days, security-event records (IP truncated to the first three octets) 180 days, desktop processed error reports and failure statistics 90 days, reproduction inputs deleted once the fix is done and at most after 30 days.

When you delete your account, account data, sessions, sign-in codes and PC registrations are deleted at deletion (for deletion at period end, on that day). Only the following is kept separately and destroyed at the end of its period: for card subscribers, subscription IDs, payment status and refund records without your email (5 years; the Merchant of Record keeps its own payment records); for organisations contracting directly with us, contract, invoice and payment records with the contact email (5 years); for refunds we could not process automatically and handled manually, the account ID (not the email), payment ID, refund amount and reason (5 years after the refund is handled); for accounts that used the free trial, a non-reversible keyed hash of the email to prevent repeat trials (1 year); for accounts refunded under the first-subscription 7-day basis or by a full refund or chargeback, the same kind of hash to prevent repeating that refund (1 year).

3a. Legal bases (EU/UK GDPR)

• Performance of a contract (Art. 6(1)(b)): your account, sign-in, licences, seats, subscription status and support.
• Legal obligation (Art. 6(1)(c)): keeping contract, payment and dispute records for the periods required by law (section 3).
• Legitimate interests (Art. 6(1)(f)): security, preventing misuse and repeat free trials, our administrative audit log, and fixing errors from diagnostics. You may object at any time by emailing us.
• Consent (Art. 6(1)(a)): reproduction inputs you choose to attach. You can withdraw by requesting deletion in the app.

We do not use your data for advertising or profiling, and we rely on consent only for reproduction inputs. Korea, where we are established, is covered by an EU adequacy decision; transfers to our processors in the USA rely on their own transfer safeguards (such as the EU–US Data Privacy Framework or standard contractual clauses).

4. Processors and international transfers

Data is transferred over the network when you use the Service and kept until the processing contract ends or you close your account. The Paddle and Polar rows above cover the data we send them to link payments to access, processed under our data processing agreements with them. Separately, card details, billing address and other information you enter at checkout are collected directly by Paddle or Polar as independent Merchants of Record under their own privacy policies (Paddle, Polar); we do not receive that information. If you do not want your data transferred abroad, you may decline to register or close your account; services that require sign-in will then be unavailable.

5. Your rights

You can delete your account yourself at any time: sign in on our website and go to Desktop start → Delete account; there is no need to cancel a paid subscription first. If a paid period remains, you can have your account deleted automatically when it ends, or delete it now and receive a pro-rata refund of the unused period. You may also request access to, correction, deletion or restriction of your personal information, or account deletion if you cannot sign in, by emailing support@coganu.com. We respond without delay and within 10 days. If you are in the EU/UK you also have rights under the GDPR, including data portability and the right to lodge a complaint with your supervisory authority.

6. Security

• Encryption in transit (HTTPS)
• Sign-in codes, session tokens and PC identifiers stored as hashes rather than in plain form
• Administrative tools reachable only on the operator's own PC, with an audit log of administrative actions
• Secrets kept separate from code, with least-privilege access

7. Cookies

We use a session cookie (up to 30 days) to keep you signed in. Language and theme preferences are stored only in your browser. We do not use advertising or tracking cookies.

8. Contact

Privacy officer: Jongwoo Hahn · support@coganu.com · 0504-2539-9719

9. Changes

We announce changes to this policy on our website at least 7 days in advance (30 days for significant changes).