Privacy Policy - Specify

1. Information We Collect

Specify is operated by 스페시파이(specify), a sole proprietorship represented by 김현중 (business registration number: 656-14-02899). Specify collects the following personal information: email address (account identification and authentication), password (encrypted via AWS Cognito). During service use, we collect document creation/editing records, AI conversation content, images you upload, content retrieved from external services you connect, and document link information, and we automatically collect access logs (IP address, access time), device information (browser type, OS), service usage events, and analytics cookie identifiers; screen interaction recordings with text and input values masked (session replay) may also be collected automatically. For payment services, partial card information is collected; full card numbers are stored only by the payment processor.

2. Purpose of Collection and Use

Collected information is used for: member management (registration, identification, authentication), service provision (document creation/editing, real-time collaboration, storage/sync, knowledge graph), AI features (document analysis, AI-assisted editing), payment processing, and service improvement (analytics, personalization).

3. Retention Period

Personal information is destroyed when the purpose of collection is achieved. Member information is retained until account deletion. As required by law: contract records are kept for 5 years, payment records for 5 years, consumer complaint records for 3 years, and login records for 3 months. However, data that entrustees retain under their own retention policies (AI processing data at OpenAI, error information at Sentry, and usage analytics data at PostHog and Google Analytics) is retained and then deleted according to each entrustee's retention policy, independently of account deletion (see Sections 6 and 8).

4. Third-Party Disclosure

Specify does not provide personal information to third parties as a rule. Exceptions include: when the user has given prior consent, or when required by law enforcement under legal procedures.

5. Processing Delegation

To provide the Service, Specify entrusts the processing of personal information as follows. (1) Amazon Web Services, Inc. (AWS): cloud infrastructure, user authentication (AWS Cognito), database operations (AWS DynamoDB), email delivery (Amazon SES), AI processing (AWS Bedrock - running Anthropic Claude models, generating embeddings for document search, and re-ranking search results), and real-time sync (AWS AppSync). (2) OpenAI OpCo, LLC (OpenAI): AI processing (running AI models through the OpenAI API). (3) Brave (Brave Search API): providing web search (search queries). (4) Paddle: payment processing and subscription management. (5) Sentry: service error monitoring (error information, account identifier, email address). (6) PostHog: service usage analytics (usage events, pseudonymous identifier, and screen interaction recordings with text and input values masked (session replay)). (7) Google Analytics: website visit analytics. Data is stored and processed in the Seoul, Korea region (ap-northeast-2) by default, but part of AI processing takes place outside Korea (see Section 6), and because entrustees (2) through (7) are businesses located outside Korea, personal information may be transferred overseas while they perform the entrusted tasks. Separately, at your direction, Specify exchanges the necessary data with external services that you choose or connect yourself (Google and Apple social login; GitHub, Notion, Slack, Jira, Linear, and Google connectors; custom MCP servers you register; and external AI clients, such as Claude Code or Codex, that you authorize to read your workspace through the Specify MCP server (mcp.specify.app)). This is not processing entrusted by Specify but an exchange at your direction, and the terms and privacy policies of those services apply.

6. AI Data Processing

Specify uses AI models from both OpenAI and AWS Bedrock (Anthropic Claude) to provide AI features. Which provider's model is used depends on the feature, your subscription plan, and the model you select, and AI models may also be used in scheduled tasks you did not request directly (such as memory and skill curation, and recurring tasks you set up). In particular, even if you select an Anthropic Claude model, OpenAI models are always used for the system's internal helper processing (summarizing conversation context, learning memories and skills, judging task completion, and recovering response formats), and Anthropic Claude models on AWS Bedrock are always used for scheduled memory and skill curation. During AI processing, the documents, conversations, images, search queries, and similar content you provide, content retrieved from external services you have connected, and the internal service identifiers needed to process them are sent to the API of the relevant AI provider. OpenAI does not use data sent through its API to train its models. OpenAI may retain requests and responses for up to 30 days for abuse monitoring (longer where required by law or reasonably necessary to prevent harm). Since October 3, 2026, Specify does not ask OpenAI to store responses for new requests, so only the abuse-monitoring retention above (up to 30 days) applies to those requests. Earlier chat and AI task responses may remain at OpenAI until they expire under OpenAI's retention policy (30 days by default). Section 8 describes what happens on account deletion; it does not guarantee that all past responses are deleted or that OpenAI will delete them. Data retained by OpenAI is deleted according to OpenAI's retention policy, independently of your Specify account deletion. AWS Bedrock does not use inputs or outputs for model training, does not share them with model providers such as Anthropic, and, for the models Specify uses, does not store prompts or outputs under its default settings. Embeddings for document search are generated with AWS Bedrock (Amazon Titan) in the Seoul region and stored in Specify's search index. For AI processing, personal information is transferred overseas as follows. (1) OpenAI OpCo, LLC: the destination is the United States and other countries; the items are the AI processing data described above; the purpose is running AI models; and the retention period is the OpenAI retention period described above. (2) Amazon Web Services, Inc.: Anthropic Claude models may be run in AWS commercial Regions worldwide, including Regions outside Korea, under AWS global cross-Region inference, and search result re-ranking is processed in the United States (us-east-1 Region). The items are the AI processing data described above; the purpose is running AI models and re-ranking search results; and, as noted above, prompts and outputs are not stored under default settings. Overseas transfers take place over encrypted network connections each time AI processing occurs. For related inquiries, contact support@specify.app.

7. User Rights

You may view, modify, or request deletion of your personal information at any time through the Settings menu or by contacting support@specify.app.

8. Data Destruction

Electronic data is destroyed using irrecoverable methods. AWS DynamoDB data is permanently deleted, and deleted information may remain in point-in-time recovery backups for up to 35 days before being destroyed automatically. Upon account deletion, all documents, conversations, and links held by Specify are deleted after the 30-day retention period following account deletion. However, this deletion is held until the OpenAI response confirmation procedure below is finished, and may be held further while an operator checks any requested response for which deletion was not confirmed. If an operator, after individual review and with an audit record, treats such a response as one whose deletion cannot be confirmed, account data deletion proceeds without confirmation that the response was deleted. Data that entrustees retain under their own retention policies is not deleted upon account deletion and is deleted according to those policies. Data retained by OpenAI in the course of AI processing follows the periods described in Section 6 (abuse-monitoring logs up to 30 days). For chat and AI task responses from before October 3, 2026, once the 30-day retention period has passed, Specify finalizes through an operational procedure a list of the OpenAI responses it has confirmed are linked to the account (an empty list if none are found) and requests deletion only for the responses on that list. This request is not automatic, and it does not guarantee deletion of all past responses or that OpenAI will delete them. In addition, error information at Sentry (including account identifiers and email addresses) and usage analytics data at PostHog and Google Analytics follow each service's retention policy.

9. Cookies

Specify uses cookies for: authentication tokens (AWS Cognito session), theme settings (light/dark/system), language preference (Korean/English/Japanese), and the last workspace you visited (specify-last-workspace, 1 year). In addition, Google Analytics cookies (_ga and _ga_<container-id>, default expiration of 2 years) are set on every page for website visit analytics. You can manage or delete cookies in your browser.

10. Privacy Officer

Privacy Officer email: support@specify.app. For additional inquiries: Korea Internet & Security Agency (privacy.kisa.or.kr / 118), Personal Information Dispute Mediation Committee (www.kopico.go.kr / 1833-6972).

11. Policy Changes

This Privacy Policy is effective from October 2, 2026. Changes will be announced 7 days in advance; significant changes 30 days in advance.