privacy-en-2026-09-21b
How Ondol Life handles personal data collected through this site.
When you use the floorplan intake we collect your name, email address, and optionally a phone number and company name. We also record the content address and SHA-256 of the floorplan you assessed.
If you submit the form, we receive the floorplan file itself and store it so our engineers can review it. Until you submit, the file stays in your browser: the assessment you see is computed locally and nothing is sent. Uploading happens only after you consent, and only as part of a submission.
We store the file under the address computed from its own contents, and we re-check that address when it arrives. We do not open, parse, convert or preview it.
To prepare and follow up a heating quotation, and to contact you about your enquiry. We do not sell personal data.
24 months from last contact. Floorplan files are held for the same period and are deleted with the rest of your record.
Where our systems are outside the country you are in, the following applies. Where you are asked for consent to this transfer, these are the exact terms you are consenting to:
| Personal data transferred | Estimate form: your name, email address, the floorplan file you submit, and its content address Contact form: your name, email address, phone number if you give one, and your message |
|---|---|
| Recipient country | United States |
| Recipient | Ondol Life Inc. |
| Contact | privacy@ondol.life |
| Purpose | Estimate form: preparing and following up a heating quotation Contact form: answering your enquiry |
| Retention period | 24 months from last contact |
You may refuse. Refusing does not withdraw an assessment already shown to you, because that was computed in your browser and never sent.
This is the whole list. If a company is not named here, we do not send it your information.
| Cloudflare | Runs the website and the estimator, at the network edge. It sees the request; it does not store your enquiry. Uploaded floorplans are stored here, privately, reachable only with an operator credential. |
|---|---|
| Xano | Holds enquiries and consent records. Currently hosted in the United States (Iowa). Your name, email address, telephone number and message are encrypted before they are sent, with the key held by Cloudflare and never by Xano — so the database itself cannot read them. |
| Shopify | Takes orders, if you place one. United States infrastructure. |
| KakaoPay | Takes payment for Korean orders. Korean infrastructure. |
We do not sell your information, and we do not share it for advertising.
We never see your card number. Payment is completed on KakaoPay's own screens, or on Shopify's. Your card details go from your device to the payment company directly; they do not pass through our systems, so we have nothing to store, lose or disclose.
What we keep is a record that an order was paid, how much, and when.
| In transit | Encrypted (TLS) between every system named above. |
|---|---|
| At rest | Name, email, telephone and message are individually encrypted (AES-256-GCM) before storage. The database holds ciphertext only. |
| Finding your records | So we can still answer a request from you, each identifier also carries a one-way fingerprint. It lets us find your records; it cannot be turned back into your email address or telephone number. |
| Floorplans | Stored privately, reachable only with an operator credential. A drawing of your home is treated as confidential whatever else it is. |
You may ask us what we hold about you, to correct it, to delete it, or to stop processing it. Contact privacy@ondol.life.
When you grant consent we record which version of the wording you were shown, the jurisdiction that applied at that moment, and what you agreed to. We keep both what your browser reported and what our server observed.
Transport is encrypted. Stored floorplans are not publicly reachable: there is no public address for them, and retrieval requires an operator credential. They are served only as downloads and are never rendered in a browser.
When this document changes its version identifier changes with it, so a consent record can always name the text that applied.