1. Introduction

distil.work ("Service") values your privacy and is committed to protecting your personal information in compliance with applicable laws, including the Korean Personal Information Protection Act (PIPA), the EU General Data Protection Regulation (GDPR), and the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA).

This policy explains what information we collect, how we use it, how long we retain it, who we share it with, processing entrustment, your rights, and how we use cookies.

1.1 Data Controller

The entity responsible for processing your personal data is:

• Service: distil.work
• Email: master@distil.work
• Website: https://distil.work

We do not currently have a designated Data Protection Officer (DPO). For all privacy-related inquiries, please contact us at the email above.

2. Information We Collect

2.1 Information You Provide

2.2 Information Collected Automatically

2.3 Information We Do Not Collect

distil.work does not require sign-up, login, or account creation. We therefore do not collect identifying information such as names, email addresses, or passwords. We also do not collect personal information about you from third parties.

3. How We Use Your Information

We use collected information solely for the following purposes:

• Service delivery: Analyzing resumes, generating scores, and producing improvement suggestions
• Service improvement: Understanding usage patterns to enhance features
• Analysis data retention: Retaining anonymized analysis data for service quality improvement and AI analysis accuracy enhancement
• Advertising: Serving display ads and rewarded video ads through Google AdSense
• Security: Detecting and preventing fraud or abuse
• Legal compliance: Fulfilling obligations under applicable laws

4. Third-Party Data Sharing

distil.work uses the following third-party services:

We do not sell or share your personal information with third parties beyond the purposes described above.

4.2 Processing Entrustment

We entrust the following processing activities to third-party service providers:

We ensure that appropriate contractual safeguards are in place to protect personal information processed by these service providers.

5. Cookies and Tracking Technologies

distil.work uses the following cookies and similar technologies:

Managing Cookies

• You can block all or specific cookies in your browser settings.
• To opt out of personalized ads from Google, visit Google Ads Settings.
• You can opt out of third-party ad cookies at the NAI opt-out page.
• You may also manage ad cookies at the DAA opt-out page.

6. Data Retention and Deletion

6.1 Retention Periods

• Resume/JD text and analysis results: Stored in anonymized form (no user identification) in our server database for up to 6 months. Automatically deleted after the retention period.
• Web analytics data: Retained in aggregated form by Google Analytics for up to 26 months.
• Server logs: Retained for up to 14 days for security purposes, then automatically deleted.

6.2 Destruction Procedures

• Process: Personal information is promptly destroyed when retention periods expire or processing purposes are fulfilled.
• Electronic files: Permanently deleted using methods that prevent recovery.
• Third-party data: Deleted in accordance with each processor's data retention policies; deletion may be requested upon User request.

7. Your Rights

Depending on your location, you may exercise the following rights under applicable law:

7.1 Korean PIPA

• Right to access your personal information
• Right to correction and deletion
• Right to suspend processing
• Right to data portability (effective March 2025)

7.2 EU/EEA — GDPR

If you are located in the EU/EEA, you have the following rights:

• Right of access
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object
• Rights related to automated decision-making and profiling
• Right to withdraw consent at any time

Legal bases for processing: Performance of a contract (GDPR Art. 6(1)(b) — service delivery), consent (GDPR Art. 6(1)(a) — advertising cookies), legitimate interests (GDPR Art. 6(1)(f) — security and service improvement).

7.3 California — CCPA/CPRA

If you are a California resident, you have the following rights:

• Right to know what personal information is collected
• Right to request deletion of personal information
• Right to opt out of the sale or sharing of personal information
• Right to correct inaccurate personal information
• Right to limit use and disclosure of sensitive personal information

distil.work does not sell your personal information. For cookie-based sharing for advertising purposes, see the opt-out methods in Section 5. If you enable a Global Privacy Control (GPC) signal in your browser, we will treat it as a valid opt-out request.

7.4 How to Exercise Your Rights

To exercise any of these rights, please contact us at master@distil.work. We will verify your identity and respond within 30 days.

8. International Data Transfers

Our servers are located in the United States. If you access the Service from Korea or the EU/EEA, your data may be transferred to the United States. Such transfers are based on your consent to our Terms of Service, and we apply appropriate safeguards to protect your information.

9. Children's Privacy

distil.work is not directed at children under 16 (or under 13 in the United States). We do not knowingly collect personal information from children. If we become aware that a child's data has been collected, we will delete it promptly.

10. Security Measures

• All data transmission is encrypted via TLS/HTTPS.
• Resume text and analysis results are stored in anonymized form with no user identification, minimizing exposure risk. Data is automatically purged after the retention period.
• Infrastructure access follows the principle of least privilege.
• We regularly review and improve our security practices.

11. Contact Us

For privacy-related inquiries, complaints, or to exercise your rights, please contact:

• Email: master@distil.work

You may also contact the following authorities:

• Korea: Personal Information Dispute Mediation Committee (1833-6972, kopico.go.kr), KISA Privacy Center (118, privacy.kisa.or.kr), Supreme Prosecutors' Office (1301), Korean National Police Agency (182)
• EU/EEA: You have the right to lodge a complaint with your local data protection supervisory authority. A list is available at the EDPB website.

12. Changes to This Policy

If we make changes to this policy, we will notify you via an announcement on the Service or on this page. For material changes, we will provide at least 7 days' prior notice and clearly indicate the effective date of the revised policy.