Privacy Policy
Effective date: September 29, 2026
variable Jar (the "Service") protects users' personal data in accordance with applicable privacy laws, including the Personal Information Protection Act of Korea, and publishes this policy to explain how personal data is handled.
1. Data We Collect
| Category | Items | How collected |
|---|---|---|
| Sign-up (Google OAuth) | Email, name, profile image | Google account connection |
| Sign-up (magic link) | Email input | |
| Service usage | Figma Variables data, project information, translation data | In the course of using the Service |
| Payment | Payment details (card number and similar) | Processed by Paddle as Merchant of Record — the Company does not store card details |
| Launch notifications (waitlist) | Waitlist form input | |
| Support inquiries | Email address, name, the subject, body and attachments of your message, and message headers (linked to your account if you are a member) | Email you send to support@variablejar.com |
| Automatic | IP address, browser information, access timestamps | Generated automatically during use |
2. Purposes of Collection and Use
- Providing the Service — member authentication, Figma Variables sync, translation workflow, team collaboration
- Member management — identity verification, preventing fraudulent use
- Service improvement — usage statistics, error diagnosis
- Billing — paid plan subscription processing
- Launch notifications — beta/official launch announcements to waitlist subscribers
- Customer support — receiving, classifying, and answering inquiries, including an automatic acknowledgement
3. Legal Bases for Processing
We process personal data on the bases set out below. The Personal Information Protection Act (PIPA) of the Republic of Korea applies to our processing; for users in the European Economic Area and the United Kingdom, the GDPR applies as well.
| Processing | PIPA | GDPR |
|---|---|---|
| Authentication, Figma Variables sync, translation workflow, team collaboration — processing necessary to provide the service | Art. 15(1)4 (performance of a contract) | Art. 6(1)(b) performance of a contract |
| Paid plan subscriptions | Art. 15(1)4 (performance of a contract) | Art. 6(1)(b) performance of a contract |
| Retention of payment records and access logs | Art. 15(1)2 (legal obligation) — Act on Consumer Protection in Electronic Commerce; Protection of Communications Secrets Act | Art. 6(1)(c) compliance with a legal obligation |
| Error diagnosis, usage analytics, prevention of abuse | Art. 15(1)6 (legitimate interests) | Art. 6(1)(f) legitimate interests |
| Receiving, triaging, and answering support inquiries | Art. 15(1)4 (performance of a contract) | Art. 6(1)(b) performance of a contract |
| Sending launch announcements to waitlist subscribers | Art. 15(1)1 (consent) and Art. 50 of the Network Act | Art. 6(1)(a) consent |
We do not ask for separate consent to processing based on performance of a contract, because that processing is necessary to use the service at all. Instead, the sign-in screen links to the Terms of Service and to this policy, and we record which version (by effective date) you accepted and when.
Where we rely on consent, you may withdraw it at any time. Launch announcements to waitlist subscribers are currently the only processing we base on consent. Contact the privacy officer named below and we will destroy the data immediately. Withdrawal does not affect the lawfulness of processing carried out before it.
Where we rely on legitimate interests, you may object at any time. If you request that we stop, we will do so unless we can demonstrate compelling grounds that override your rights.
4. Retention Periods
- Member information — until account deletion; destroyed immediately upon deletion.
- Service usage data — deleted by CASCADE upon account deletion.
- Projects in the trash — kept for 30 days after being moved to the trash, then automatically and permanently deleted together with their data, including variables, collections, change history, translation sheets, comments, and Figma file links. A project deleted permanently from the trash is deleted immediately.
- Waitlist emails — destroyed within 6 months after the launch notification is sent.
- Payment records — retained for 5 years under Korean e-commerce law.
- Access logs — retained for 3 months under Korean communications privacy law.
- Support inquiries — retained for up to 3 years as records of consumer complaints and dispute resolution under Korean e-commerce law, including after account deletion. Messages identified as spam are deleted from our support records within 30 days.
5. Provision to Third Parties
The Service does not provide personal data to third parties, except when:
- the user has given prior consent; or
- required by law or requested by investigative authorities.
6. Processors
| Processor | Delegated work |
|---|---|
| Supabase Inc. | Database hosting, authentication |
| Cloudflare Inc. | Website hosting, CDN, AI translation, receiving and forwarding support email, sending automatic acknowledgements |
| Paddle.com Market Ltd. | Payment processing (Merchant of Record) |
| Google LLC | OAuth authentication; support mailbox (Gmail) — storing and replying to support email |
| OpenAI OpCo, LLC | AI translation and terminology analysis, classification and summarization of support inquiries |
| Plus Five Five, Inc. (Resend) | Sending sign-in and invitation emails and staff replies to support inquiries |
Transfer of personal data overseas
Through the processors above, the Service transfers personal data outside Korea as follows (Personal Information Protection Act, Article 28-8). Each recipient's contact details are in the privacy policy linked from its name.
| Recipient (country) | Items | When and how | Purpose | Retention |
|---|---|---|---|---|
| Supabase Inc. (USA; data stored in the Seoul, Korea region) | Account and service data | Continuously over encrypted connections while you use the Service | Database hosting, authentication | Until account deletion |
| Cloudflare Inc. (USA) | IP address and access information, text submitted for AI translation, support emails | Over encrypted connections when you access the Service, request a translation, or email support | Hosting and CDN, AI translation, receiving and forwarding support email, sending automatic acknowledgements | Until the purpose is fulfilled, or as the recipient's retention policy provides |
| Google LLC (USA) | Email, name, profile image; support emails | When you sign in with Google; when a support email is forwarded | OAuth authentication; support mailbox | Until account deletion (sign-in data); up to 3 years (support email) |
| OpenAI OpCo, LLC (USA) | Text submitted for AI translation; subject, sender address and body of support emails | Over encrypted connections when you request a translation or email support | AI translation and terminology analysis; classifying and summarizing support emails | As the recipient's API data retention policy provides |
| Plus Five Five, Inc. (Resend) (USA) | Email address, email content | When sign-in, invitation, or support reply emails are sent | Email delivery | As the recipient's retention policy provides |
| Paddle.com Market Ltd. (United Kingdom) | Email, payment details | At checkout | Payment processing (Merchant of Record) | As the recipient's retention policy provides |
You can refuse these transfers by not using the related feature (Google sign-in, AI translation, emailing support) or by deleting your account. Transfers needed for the core features cannot be refused while using the Service.
7. AI Processing and Data Handling
- When you request AI translation, the text to be translated is sent to our translation processing providers solely to produce the translation result.
- We recommend not including personal data in text submitted for translation.
- Emails sent to support@variablejar.com are classified and summarized by an AI model so that our staff can review them quickly. The results are used internally only; the automatic acknowledgement you receive is fixed text and is not written by AI.
8. Your Rights
Users may exercise the following rights at any time:
- request access to their personal data;
- request correction of errors;
- request deletion;
- request suspension of processing.
Requests can be sent by email to the privacy officer below and will be handled without delay.
9. Destruction of Personal Data
Personal data is destroyed without delay once the retention period expires or the purpose of processing is achieved. Electronic files are deleted irrecoverably; printed materials are shredded or incinerated.
Upon an account deletion request, member information and all associated data (collections, variables, projects) are deleted immediately by CASCADE. A project moved to the trash is automatically and permanently deleted, together with its data, including variables, collections, change history, translation sheets, comments, and Figma file links, 30 days after it was moved; deleting it permanently from the trash deletes it immediately. Support inquiries are kept for the period stated in Section 4 and then destroyed.
10. Privacy Officer
- Officer: Wonkyu Kim
- Email: support@variablejar.com
11. Information Received Through Google Sign-In
When you sign in with Google, the Service requests only the basic scopes (openid, email, profile).
- Data we receive — your Google account's name, email address, and profile image.
- How we use it — only to create your account, authenticate you when you sign in, and identify you to the other members of the workspaces you belong to.
- Storage and retention — stored in the Service's database and destroyed immediately when you delete your account (Section 4).
- Sharing — we do not sell it or use it for advertising, and we do not provide it to anyone other than the processors listed in Section 6.
variable Jar's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
12. Changes to This Policy
This policy applies from its effective date. Changes are announced through notices within the Service. This English version is the governing text; translations are provided for reference only.