CarDrawer Privacy Policy
Effective date: October 19, 2026
Version: October 19, 2026 · privacy-2026-10-18-draft1
Privacy policy · Terms of service · Processors · Delete account
This policy applies to CarDrawer (차서랍), a business service for used-car dealers in Korea, consisting of the Android app com.sugarmount.cardrawer and related web pages (the "Service"), provided by Simpest21 (Google Play developer name SugarMount; "we", "us"). It describes what the current build actually does. If we turn on a new feature or change how we process data, we update this policy first. If this English version differs from the Korean version, the Korean version prevails.
1. Summary
- CarDrawer helps used-car dealerships and dealers organise receipts, documents, costs and deadlines per vehicle. It is a business service. Only people aged 19 or older who work in the used-car trade (owners, dealers, office staff) may create an account.
-
We handle two kinds of personal information:
- User data — information about the dealers and staff who create accounts (email, display name, etc.). We process it as the controller (개인정보처리자).
- Information inside a dealership's business records — names and contact details of vehicle owners, buyers and service providers that appear in contracts, registration certificates and receipts uploaded by a dealership. The dealership is the controller of this data. We process it only as the dealership's processor (수탁자) within the scope of our data processing agreement (Section 8).
- As a rule we do not collect resident registration numbers, driver's licence numbers, passport numbers or alien registration numbers. The app asks you to mask them yourself with its masking tool before upload. Our server masks resident registration, mobile phone and card number patterns in the text the AI reads before it is stored. An original image you upload without masking may still contain such numbers (Section 3-3).
- Photo metadata such as GPS location is removed on the device before upload. The app does not request location permission.
- Document reading uses Google's generative AI (Vertex AI Gemini, paid tier). Google does not use this data to train its models. Processing may take place outside Korea (Section 9).
- AI output is only a suggestion. Critical values such as amounts, vehicle assignment and accident-related marks are confirmed only after a person approves them. We make no automated decisions about individuals.
- The app contains no advertising SDK (such as AdMob) and does not use the advertising ID. We do not sell personal information.
- You can delete your account in the app (Settings > Delete account / organisation) or on our deletion request page.
2. Purposes
| Area | Purpose |
|---|---|
| Account | Sign-up and sign-in, account verification, self-confirmation that you are 19+ and work in the trade, abuse prevention |
| Organisation | Creating a dealership workspace, inviting members, roles and permissions, seats and usage limits, revoking access when a member leaves |
| Service | Registering vehicles and deals, storing photos and PDFs, AI extraction with human review, cost and settlement calculation, deadline reminders, sales-preparation checklists, exports (CSV, ZIP) |
| Processing on behalf of dealerships | Storing, structuring, viewing and exporting information about vehicle owners, buyers and others in uploaded records (Section 8) |
| Contract and billing | Concluding contracts, quotes and Korean tax invoices, payment confirmation, overdue and termination handling |
| Support and notices | Answering enquiries and bug reports, handling AI-output reports, notices about service, terms and security incidents |
| Quality and security | Crash diagnosis, non-identifying usage statistics, blocking tampered apps and automated requests, access logs |
| Marketing (optional) | Product news only to users who opted in (email, app push). All features work without opting in |
3. Personal information we process
3-1. User data (we are the controller)
| Category | Items | Required / optional |
|---|---|---|
| Account | Email, display name, sign-in method (Google Sign-In or email link), account ID (UID), consent versions and timestamps for terms, privacy policy and AI notice, 19+ business-user confirmation | Required |
| Organisation and members | Business name, province/city, operating mode, main purchasing channels, member role, permissions, status, last access | Required |
| Business details | Used-car dealer registration number, business registration number, association | Optional |
| Contract and billing | Contact person's name, email and phone; business name, representative name, business registration number, address, business type (for tax invoices); payer name, date and amount of bank transfers; contract terms | Required for paid contracts (collected outside the app) |
| Consent records | Marketing consent per channel and for night-time messages, change history, consent screen and text version | Optional |
| Device and automatic | Push token, Firebase installation ID, app instance ID, app integrity verdict (Play Integrity), app and OS version, device model, access logs (time, request ID, function), crash data | Required (integrity, access logs); optional (analytics, crash reports) |
| Usage statistics | Screen and feature events (no plate numbers, names, amounts or document content; amounts only as ranges), hashed organisation ID | Optional (can be turned off) |
| Support and reports | Your email and message, app version, device model, error code, AI-output report target and reason | Optional |
3-2. Information in dealership records (dealership is controller, we are processor)
| Category | Items (where present in records) |
|---|---|
| Vehicle | Registration plate (including past plates), VIN, odometer, model, year, specifications, inspection report content, accident and replacement marks, seizure or mortgage status |
| Counterparties | Names, phone numbers, addresses, business registration numbers of owners, sellers, buyers, transport drivers and repair shops; signature or seal images if not masked |
| Deal and cost | Purchase and sale prices, cost items and amounts, payment records, receipt images that may show bank details |
| Original files | Photos and PDFs (masked if you masked them before upload), SHA-256 hash, upload time, uploader, source channel |
| AI results | Extracted values and original text, page and region, review level, approver and approval time |
| Notes | Notes and work orders written by members |
3-3. What we do not process
- Resident registration, driver's licence, passport and alien registration numbers are not collected as a rule. The app asks you to mask them yourself before upload. The app does not yet detect or mask these numbers automatically, so an original image uploaded without masking is stored as is and is also used for AI processing. Our server masks resident registration, mobile phone and card number patterns in the text the AI reads (extracted values, source wording, notes) before it is stored. If you find an unmasked original, delete it and upload a masked copy.
- Location: no location permission. GPS and other photo metadata and PDF author fields are stripped on the device before upload. Addresses are handled only as text and are never geocoded.
- No contacts, call logs, SMS, device calendar or advertising ID. No card numbers or other payment instruments.
- We do not ask for sensitive information such as health or beliefs.
4. Retention
4-1. User data
| Data | Retention |
|---|---|
| Account | Until account deletion. We aim to delete from the live database within 72 hours of a request |
| Organisation and members | Until the 30-day data-return period after termination ends |
| Consent records | Until account deletion; marketing consent and withdrawal records 1 year after withdrawal |
| Contract and billing records | 5 years (Korean Framework Act on National Taxes, VAT Act); contract and payment records 5 years and complaint records 3 years under the E-Commerce Act Enforcement Decree Art. 6 |
| Access logs | At least 1 year (Standards for Personal Information Security Measures, Art. 8); at least 2 years where those Standards require it |
| Crash data (Crashlytics) | 90 days |
| Usage statistics | 2 months |
| Support and reports | 3 years after closure |
4-2. Dealership records (processed on behalf of the dealership)
| Data | Retention |
|---|---|
| Vehicles, deals, costs, original files | For the term of the contract as the dealership decides; deleted when members delete them |
| Vehicle inspection report copies | By default kept until 1 year after issue, to help the dealership meet its retention duty (Motor Vehicle Management Act Enforcement Rule Art. 120), then deleted. Configurable by the dealership |
| Raw AI responses | 30 days after processing |
| Backups | We keep no separate long-term backups and rely on Google Cloud's built-in data protection and recovery features. Deleted data may therefore remain in recovery copies for up to 35 days after deletion; if we restore from such a copy, we re-apply deletion requests made in the meantime |
| On termination | Request → 30 days to export → deletion. Records the dealership marked for legal retention are kept separately until expiry, then deleted |
| Trial not converted | Read-only and export for 30 days, then deletion after email notice |
4-3. Deleting a staff account
When a staff member deletes their own account, the dealership's business records they uploaded are not deleted, because they belong to the dealership. Uploader and approver labels change to "deleted member" with an internal ID. Deletion of dealership records is requested by the dealership's administrator.
5. Destruction
Scheduled server jobs irreversibly delete database documents, sub-items and stored files (originals, AI input copies, exports), together with derived search fields and notification records. Device caches are cleared on next sync. Export download links expire after 15 minutes and export files are deleted after 7 days. We do not accept paper records; printed contracts are shredded.
6. Disclosure to third parties
We do not sell personal information and do not provide user data to third parties, except: where required by law (e.g. a warrant); tax-invoice data sent to the National Tax Service (Hometax) under the VAT Act. Exports and shares you make yourself (CSV export, Android share sheet) are your actions; you choose the recipient. The app never posts, sends or submits on your behalf. Dealership records are processed as a processor and are not disclosed without the dealership's instruction.
7. Processors
| Processor | Tasks |
|---|---|
| Google LLC | Authentication (Firebase Authentication, Google Sign-In); database, server functions and file storage (Cloud Firestore, Cloud Functions, Cloud Storage — Seoul region); push notifications (Firebase Cloud Messaging); app integrity (Firebase App Check, Play Integrity); crash reporting (Firebase Crashlytics); usage statistics (Google Analytics for Firebase); document extraction and draft generation (Vertex AI Gemini, paid tier); support email (Gmail) |
For dealership records, Google LLC acts as our sub-processor, to which the dealership consents in the data processing agreement. The list and its change history are published on our sub-processor page. We update this policy and notify dealerships 30 days before adding a processor (for example, a web card-payment provider).
8. Dealership records — when we act as processor
- The dealership is the controller for its customers' data; we are its processor under Article 26 of the Personal Information Protection Act (PIPA).
- We do not use this data outside the agreed tasks: not for our marketing, not for AI model training, not for other customers.
- Terms (tasks, sub-processors, safeguards, transfers abroad, return and deletion) are set in the Data Processing Agreement the dealership's administrator accepts in the app when creating the organisation (version and time stored). A signed paper version is available on request.
- Vehicle owners, buyers and other data subjects should first contact the dealership to access, correct or delete their data. If they contact us, we forward the request to the dealership without delay and assist.
- We provide dealerships with notice text they can use in their own privacy notices.
- When uploading, users confirm they are entitled to process the file. Screens and auction diagnoses from other platforms (e.g. HeyDealer, Encar) are stored only and never sent to AI.
9. Transfers abroad (PIPA Art. 28-8)
User data is transferred abroad as processing and storage necessary to perform the contract (Art. 28-8(1)(3)). Dealership records pass through the same route as sub-processing.
| Recipient (contact) | Country | Items | Purpose | When and how | Retention |
|---|---|---|---|---|---|
| Google LLC — Firebase Authentication / Google Sign-In (contact) | USA and other countries with Google data centres | Email, display name, sign-in method, UID, sign-in time | Sign-up, sign-in | At sign-up and sign-in, encrypted | Until account deletion |
| Google LLC — Cloud Firestore, Cloud Functions, Cloud Storage (Seoul region) | Republic of Korea (stored in Seoul); may be accessed from the USA and other Google locations for operations and support | Account and organisation data (3-1), all dealership records including original files (3-2) | Service provision and storage | During use, encrypted | As in Section 4 |
| Google LLC — Vertex AI Gemini (paid tier, global endpoint) | Google global infrastructure; Google selects the region per request, which may be outside Korea (e.g. USA) | Document images you submit for AI (masked if you masked them before upload), confirmed vehicle fields for draft descriptions | Extraction, draft generation | When you upload, re-read or generate a draft, encrypted | Not used by Google for training; Google-side retention follows the Google Cloud terms and Vertex AI data processing terms; raw responses on our server 30 days |
| Google LLC — Firebase Cloud Messaging, App Check, Installations | USA etc. | Push token, installation ID, integrity verdict | Notifications, blocking tampered apps | At sign-in, notification registration and server requests | Until sign-out or uninstall |
| Google LLC — Firebase Crashlytics | USA etc. | Stack traces, device model, OS and app version, Crashlytics ID (no input, photos or records) | Crash diagnosis | Next launch after a crash | 90 days |
| Google LLC — Google Analytics for Firebase | USA etc. | App instance ID, usage events (no identifying data or record content), device and app info | Usage statistics | During use | 2 months |
| Google LLC — Gmail (support) | USA etc. | Your email, message, attached diagnostics | Support | When you contact us | 3 years after closure |
How to refuse and the effect: you may decline to sign up or delete your account. These transfers are necessary for core functions (sign-in, storage, AI extraction), so the Service cannot be used without them. Usage statistics and crash reports can be turned off in Settings > Privacy & AI without affecting the Service. We do not describe the Vertex AI location as "USA" because it is not fixed; if we change it, we update this table first.
10. AI notice (Korean AI Framework Act)
- CarDrawer uses generative AI (Google Gemini) to read values from receipts, contracts and inspection reports and to draft sales descriptions from confirmed data. Before first use, the app shows this notice separately and records your acknowledgement.
- AI output is labelled "AI suggestion" and becomes "Confirmed" (approver, time) only after a person approves it. Amounts, vehicle assignment, plate number, VIN, odometer, inspection and issue dates, accident or replacement marks, and seizure or mortgage status always require human approval.
- AI output can be wrong. Drafts never include unverified claims such as "accident-free", "warranty" or "lowest price". The dealer is responsible for checking content before publishing it.
- Use the "Report a problem" button next to any AI result to tell us about errors. Reports are used only for quality and error handling.
- We do not use business records to train AI models, and under Vertex AI paid-tier terms Google does not either. We do not use free AI APIs.
- Purchase-limit, deadline, cost and profit calculations use fixed formulas, not AI. We make no assessments or automated decisions about vehicle owners or buyers.
11. Your rights
You may request access, correction, deletion or suspension of processing, and withdraw consent at any time — in the app (Settings), on the deletion request page, or by email to sugarmount21@gmail.com. We respond within 10 days after verifying your identity. We may restrict a request where the law requires retention or where it would infringe others' rights, and we will tell you why. Legal representatives and authorised agents may request with a power of attorney. Requests from a dealership's customers are handled first by the dealership (Section 8). People under 19 cannot create accounts, and we do not knowingly collect data of children under 14.
12. Automatic collection tools
| Tool | Use | How to refuse |
|---|---|---|
| Push token, Firebase installation ID | Deadline and approval notifications | Turn off notifications in device settings; deleted on sign-out |
| App Check (Play Integrity) | Blocking tampered apps and automated requests | Cannot be refused (security) |
| Google Analytics for Firebase | Feature usage. No user ID; no plate numbers, names, amounts or document content; Google signals and advertising features off | Settings > Privacy & AI > Send usage statistics |
| Crashlytics | Crash diagnosis. No input, photos or records | Settings > Privacy & AI > Crash reports |
The app does not use web cookies or the advertising ID. Our web pages are hosted on GitHub Pages without analytics tools.
13. Marketing messages
We send marketing messages only to users who explicitly opted in, per channel (email, app push), default off. Messages between 9 p.m. and 8 a.m. require separate consent. Each message is marked "(광고)" (advertisement) and shows the sender, contact and how to unsubscribe. You can withdraw in Settings > Notifications at any time; we confirm the result. We re-confirm consent every 2 years from the date it was given (Enforcement Decree of the Network Act, Art. 62-3). Service notifications (deadlines, approvals, security) are not marketing. Allowing Android notifications is not marketing consent. We never send unsolicited marketing to publicly listed dealership phone numbers or emails.
14. Security measures
- Administrative: internal management plan, least-privilege operator access. Operators access dealership data only through a support grant approved by the dealership owner, with a stated purpose and expiry (default 24 hours), and it is logged.
- Technical: TLS for all transfers, cloud encryption at rest, per-organisation isolation and role-based access (purchase prices, costs and counterparties behind separate permissions), app integrity checks on server functions, 15-minute signed download links, two-factor authentication for consoles, secrets in Secret Manager.
- Logs: views, exports, permission changes and support access are audit-logged with IDs and masked values only. Server logs, crash reports and analytics never contain document text, extracted values or images.
- Originals: uploads are never overwritten and are stored with a hash and upload details.
- Incidents: if a breach or likely breach is confirmed, we notify affected users and authorities without delay (within 72 hours at the latest), and immediately notify the dealership where its records are involved.
15. Privacy officer and contact
- Chief Privacy Officer: Simpest (Simpest21)
- Email: sugarmount21@gmail.com
- Business details: Simpest21. The representative's name, business registration number, mail-order business report number and business address are provided by email (sugarmount21@gmail.com) on request.
You may also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118), the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972), the Supreme Prosecutors' Office cyber unit (spo.go.kr, 1301) or the Korean National Police Agency cyber bureau (ecrm.police.go.kr, 182).
16. Changes
We announce changes in the app and on this page 7 days before they take effect (30 days for changes unfavourable to users or for new processors or transfers). We update this policy before turning on new features. Previous versions remain listed below.
- Draft of 18 October 2026 (pre-launch): first version.