Privacy Notice

ComePass provides source-verified Korean company information for AI agents, developers, and investors without user accounts, cookies, or login sessions.

1. What We Collect (Request Telemetry)

To measure service demand by request category, each incoming request records only the following fields in the events table:

• Timestamp (ts): Request time in UTC ISO-8601 format.
• Path & Status (route, status, module, class): Normalized URL path (without query strings), HTTP status code, target module ID, and traffic class (e.g., agent_user, mcp_call, api_call, ai_search_crawler, ai_training_crawler, search_engine, human, internal, unknown_bot).
• Bot / Client Family (ua_family): Sanitized family identifier only (e.g., chatgpt-user, claude-user, browser, api-client, mcp-client).
• Weekly Rotating Pseudonymous Key (client_key): One-way SHA-256 hash sha256(ua_family | ip | YYYY-Www | TELEMETRY_SALT) that automatically rotates every UTC ISO week (Monday–Sunday).
• Referer Domain (referer_host): Hostname of the HTTP Referer header only (path and query parameters are stripped; null if absent).
• Request Signals (signals): Yes/no bits recording whether certain request headers were present. Header values are not stored.
• Network (asn, as_org): The network number and organization name of the requesting network, as reported by Cloudflare. This identifies a network, not a person.
• MCP usage (mcp_method, tool, mcp_ok): The MCP method, the tool name if it is one of ours, and whether the call succeeded. Tool arguments are not stored.
• Crawler check (verified): Whether a request naming a known crawler came from that crawler's own network.
• Supplier page id (page_id): For a published supplier page only, a salted one-way hash of its business registration number, to count how many different pages were fetched.
• Internal Flag (is_internal): Whether the request is ComePass's own operational traffic, so it can be excluded from demand counts.

2. What We Do Not Collect or Store

• Raw IP addresses: Client IP is read transiently in memory solely to compute the weekly client_key hash and is never written to storage or logs.
• Full User-Agent strings: Only the short ua_family token is stored.
• Cookies or session identifiers: This service sets no cookies and requires no login.
• Queried business registration numbers: Korean 10-digit business registration numbers submitted to /api/v1/kr-business-status or the kr_business_status MCP tool are forwarded on demand to the National Tax Service API and are never stored in events, cached, or written to application logs.
• Hosting provider: Requests pass through Cloudflare, which hosts this service and processes request data such as IP addresses and URLs to deliver it. We keep Cloudflare's per-request Workers logs turned off so that URLs and IP addresses are not retained there for us.

3. Retention Period

• 90-day event retention: Rows in events older than 90 days are automatically purged by a daily scheduled job (0 3 * * * UTC).
• Daily usage counts (usage_daily): Per day, request counts by class, client family, network type (data center or not), page group, tool, and outcome, plus the number of distinct weekly keys and supplier pages. No IP address, client key, or page id is kept, and these counts are retained beyond 90 days. Older daily_rollup rows are no longer written.

4. The Korea Filings Brief Waitlist

• Collected Items: Email address (required) and optional survey responses (“Which 3 Korean stocks would you track first?” and “How do you use AI for investing?”), plus acquisition source (UTM parameter or referrer domain only) and the weekly pseudonymous client_key for daily rate limiting (raw IP addresses and full User-Agent strings are never stored).
• Purpose: Service launch notification for The Korea Filings Brief.
• Retention: Retained for 12 months after the launch notification is sent, or deleted immediately upon a deletion request.
• Deletion Request & Inquiries: To delete your waitlist record or ask a question at any time, email contact@comepass.xyz.

5. Public Data Sources & Contact

• Public Sources: Corporate filings and financial statements from Korea's Financial Supervisory Service (OpenDART); business registration status from Korea's National Tax Service (NTS); public procurement contract and supplier records from Korea's Public Procurement Service (KONEPS) via data.go.kr.
• Contact: contact@comepass.xyz