Privacy Policy

KDX Labs Corp. ("we", "us") operates SkillCDN (https://skillcdn.ai, the "Service"). This policy explains what personal data the Service processes, why, and for how long. The Service has no sign-up and never asks for your name or contact details.

1. What we process, why, and for how long

Data	Items	Purpose	Retention
Access logs (collected automatically with every request)	IP address, browser or client information (User-Agent), requested path (without its query string), time of the request, response status and duration, request identifier	Providing the Service, diagnosing errors, security and abuse prevention	Deleted automatically after 90 days
Usage statistics	Daily counts per repository. Distinct users are counted by hashing IP addresses with a key for the day; the IP addresses themselves are not stored.	Showing how repositories are used	Hashes are deleted when the day's count is complete (about one day). The counts contain no personal data.
Enquiries and reports (when you email hi@skillcdn.ai)	Email address, name (if given), message and attachments	Answering you, handling removal requests and reports, dealing with related disputes	3 years after the matter is closed
Analytics (only with your consent)	Google Analytics cookie identifiers, pages visited and interactions, browser and device information, approximate location derived from the IP address	Learning which pages help, to improve the Service	Up to 14 months after collection
Personalized advertising (only with your consent)	The same items as analytics, and Google advertising cookie identifiers	Advertising SkillCDN to you through Google's advertising (remarketing), measuring our ads, reports on visitors' interests and demographics	Up to 14 months after collection; what Google uses for its own purposes is governed by Google's privacy policy

The Service indexes and serves content published in public repositories, which may contain personal data such as authors' names or email addresses. We keep it while the repository is public and served by the Service, and delete it when we receive a removal request or block the repository. Deleted content may remain in database backups for up to 14 days.

We process access logs, usage statistics, repository content, and enquiries and reports on the basis of our legitimate interest in providing and protecting the Service and in answering requests (Article 6(1)(f) GDPR; Article 15(1)(6) of Korea's Personal Information Protection Act). We process analytics and advertising data on the basis of your consent (Article 6(1)(a) GDPR; Articles 15(1)(1) and 17(1)(1) of the Personal Information Protection Act). Where the law requires us to keep personal data, we keep it for the period it sets.

2. Deletion

We delete personal data without delay when its retention period ends. Access logs are deleted automatically at the end of their retention period, usage statistics hashes are deleted every day, and enquiry emails are deleted from the mailbox when their retention period ends. Analytics and advertising data are deleted at the end of the retention period set in Google Analytics. Electronic files are deleted so that they cannot be recovered; we do not keep personal data on paper.

3. Sharing

We do not sell personal data or share it with third parties, except:

1. If you consent to personalized advertising, we share the following with Google for advertising. Refusing has no effect on your use of the Service.

Recipient	Purpose	Data	Retention
Google LLC (United States, googlekrsupport@google.com)	Personalized advertising and measuring ads	Pages visited and interactions, cookie identifiers, browser and device information, approximate location	As set out in Google's privacy policy

Google acts as an independent controller for this data and may combine it with what it knows about users signed in to a Google account (Google signals). The data is sent over the network to Google in the United States when you visit a page after consenting.

2. When authorities require it through lawful procedures.

4. Service providers and international transfers

We use the service providers below to run the Service. They process personal data on our behalf, outside Korea.

Provider (contact)	What they do for us	Location	Data	When and how	Retention
Amazon Web Services, Inc. (aws-korea-privacy@amazon.com)	Servers and database, storage of access logs	United States	Access logs, usage statistics, repository content	Sent over the network when you use the Service	As in section 1
Cloudflare, Inc. (privacyquestions@cloudflare.com)	Delivering and protecting requests (content delivery, security), forwarding enquiry emails	United States and the countries where Cloudflare runs its network	Request data such as IP addresses, enquiry emails	Sent over the network when you use the Service or send an email	As set out in Cloudflare's privacy policy
Google LLC (googlekrsupport@google.com)	Receiving and storing enquiry emails (Google Workspace), analytics (Google Analytics)	United States and the countries where Google runs data centers	Enquiry emails; analytics data if you consent	Sent over the network when an email arrives, or when you visit a page after consenting	As in section 1

Transfers of data about people in the EU, EEA or UK rely on the safeguards in these providers' data processing terms, such as the European Commission's Standard Contractual Clauses. Every request passes through Amazon Web Services and Cloudflare, so you can only avoid transfers to them by not using the Service. You can refuse analytics and advertising by not consenting or by withdrawing consent, without any effect on your use of the Service.

5. Cookies and browser storage

1. By default, the Service sets no cookies. It stores only your language (skillcdn.lang) and your consent choice (skillcdn-consent) in your browser's storage (localStorage). These stay on your device and are never sent to us.
2. Google Analytics and Google's advertising tags are loaded only if you agree in the notice on the page, and they then set Google Analytics and Google advertising cookies (such as _ga and _gcl_au). Without your consent, storage and data use for analytics and advertising all stay denied. If your browser sends a Global Privacy Control or Do Not Track signal, we never ask and never load them.
3. To withdraw consent, clear this site's cookies and stored data in your browser; you will be asked again on your next visit. You can also use the Google Analytics opt-out browser add-on.

6. Personalized advertising

We collect information about your use of the Service for personalized advertising only if you consent.

• What: pages visited, interactions, time of visit, cookie identifiers, browser and device information
• How: collected automatically by Google's tags when you visit a page after consenting
• Why: personalized advertising through Google's advertising, and measuring our ads
• Who collects and processes it: Google LLC
• For how long: up to 14 months after collection; what Google uses for its own purposes is governed by Google's privacy policy
• How to refuse: do not consent or withdraw your consent, turn off personalized ads in Google's My Ad Center, or block cookies in your browser

We do not collect sensitive information such as health or beliefs for advertising, and we do not direct personalized advertising at children under 14. Questions about advertising can be sent to hi@skillcdn.ai.

7. Your rights

1. You may at any time ask to access, correct or delete your personal data, ask us to restrict or stop processing it, object to its processing, or withdraw your consent. Where the law provides for it, you may also receive your data in a portable format. Write to hi@skillcdn.ai and we will act without delay, within the period the law sets.
2. We can only tell access log entries apart by IP address. Please include your IP address and the time you used the Service so we can find the entries.
3. You may also make a request through a legal representative or someone you authorize. A request may be limited where the law requires us to keep the data or where it could harm the rights of others.

8. Security

• All connections are encrypted with TLS.
• The database, its backups and the logs are encrypted at rest, and the database sits in a private network that cannot be reached from the internet.
• Our systems can be reached only through personal accounts with multi-factor authentication, access is limited to what each task needs, and access is logged.
• Passwords and keys are kept in a dedicated secret store, never in code or logs.

9. Children

The Service is not directed at children under 14, and we do not knowingly collect their personal data.

10. Who is responsible

The controller of your personal data is KDX Labs Corp. Our privacy officer is the Chief Executive Officer, who can be reached at hi@skillcdn.ai.

11. Complaints

You can complain to the data protection authority where you live or work. In Korea, you can contact:

• Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
• Personal Information Infringement Report Center: 118, privacy.kisa.or.kr
• Supreme Prosecutors' Office: 1301, www.spo.go.kr
• Korean National Police Agency: 182, ecrm.police.go.kr

12. Changes to this policy

We announce changes to this policy on this page at least 7 days before they take effect, or at least 30 days before for significant changes such as new kinds of data or new purposes. This policy is available in Korean and English; if the two versions differ, the Korean version prevails.

This policy takes effect on September 26, 2026.