JRB LAB processes personal information only as needed to operate JRB LAB accounts, ARCQ DOCS, Mastard by Arcq and related web services. ARCQ SPL and Arcq Live do not require an account.
1. Controller
JRB LAB (제이알비랩) · Representative: Bae Jiyeol (배지열)
Business registration: 634-14-01944 · Online sales report: 2026-Seoul Songpa-1147
101 Jungdae-ro, 4F Suite 414, Songpa-gu, Seoul, Republic of Korea
Privacy contact: [email protected]
2. Data, purpose and retention
| Area | Data | Purpose | Retention |
|---|---|---|---|
| Account | Name, email, login-provider ID, password hash and verification status | Identity, sign-in, security, licenses and service delivery | Until account deletion; unverified email accounts are removed within 7 days |
| Optional profile | Display name, contact details, role and vehicle information | ARCQ DOCS crew identification and field collaboration | Until deleted by the user or account deletion |
| Licenses and purchases | Purchase email, order or subscription IDs, license key, device ID, app version, platform and activations | Payment verification, licensing, activation and fraud prevention | For the contract and periods required by applicable law |
| ARCQ DOCS | Show documents, crew email and permissions, comments, attachments, edit presence and push token | Sync, collaborative editing, sharing and notifications | Until document or account deletion; transient presence only as needed |
| Mastard | Profile, shared sessions, invites, comments, playback records, audio and derived data, device and notification information | Private master review, playback, collaboration and notifications | Until session or account deletion, plus a short operational cleanup period |
| Support and security | Contact content, access time, route, error and security audit records, and IP where required for security | Support, incident response, abuse prevention and minimal statistics | Support: 1 year; raw audit and statistical records: 90 days |
| Optional marketing | Email and consent status, time and policy version | Product updates and news | Until withdrawal or account deletion; sending is currently disabled |
3. Legal basis and consent
Processing is based on contract performance, user requests, legal obligations, legitimate security needs or separate consent. Required processing and optional marketing consent are separated. Declining marketing does not limit account or product use.
4. Processors and international transfers
Encrypted transfers occur when the relevant feature is used.
| Provider | Role and data | Location and timing | Retention |
|---|---|---|---|
| Cloudflare, Inc. | Web hosting, security, Turnstile and Mastard R2 storage; request, security-verification and uploaded-file data | Cloudflare global network, including Korea; Mastard storage in APAC, when requests or uploads occur | Under Cloudflare policy and contract; stored files until user deletion or service termination |
| Railway Corporation | Authentication, licensing, ARCQ DOCS and Mastard server and database hosting | California, United States (us-west2), when account and service features are used | Under the periods stated above and provider backup-deletion procedures |
| Plus Five Five, Inc. (Resend) | Account, reset and support email delivery; recipient, name, subject and message content | United States, when an email is sent | For delivery, security and legal obligations |
| Google LLC | Optional Google sign-in and receipt of company inquiries; OAuth ID, email, name and inquiry content | Google service regions, when selected or an inquiry is sent | Until disconnection or deletion under Google policy |
| Apple Inc. | Optional Apple sign-in, push notifications and App Store transactions | Apple service regions, when the relevant feature is selected | Until disconnection or as required for platform transactions |
| Sold through Link, LLC (Lemon Squeezy) | Future web payment, subscription and license processing; buyer and transaction information | United States, only if web sales are enabled and a purchase is initiated | For transaction, tax and dispute periods under applicable law and provider policy |
Web sales and optional marketing email are currently disabled. Refusing an optional transfer does not affect unrelated features. Refusing a transfer required for an account or collaboration feature may prevent use of that feature.
5. Third-party disclosure
We do not disclose personal information for an independent third party's own purpose unless required by law or separately authorized. Processors and user-selected OAuth or payment providers are described above.
6. Children
JRB LAB accounts are intended for users aged 18 or older. We do not knowingly collect personal information from children under 14 without lawful guardian consent.
7. Your rights
You may request access, correction, deletion, restriction or withdrawal of consent through My Account or [email protected]. Identity verification may be required.
8. Deletion and security
Expired data is securely deleted or segregated when retention is legally required. We use encrypted transport, one-way password hashing, access controls, administrator authentication, rate limits, audit records and token revocation. Plain-text passwords are never stored.
9. Local storage and analytics
localStorage or sessionStorage maintains sign-in and consent state. Optional homepage visit and click analytics are currently disabled. Essential authentication and security records remain active.
10. Changes
Material changes to purposes, data, disclosures or international transfers will be announced before they take effect. Separate consent will be requested where required.