One-sentence summary.
Modfolio Connect collects only the minimal identifying data and authentication credentials needed for users to sign in to modfolio ecosystem apps, processes them according to standards (OIDC/WebAuthn), and automatically cleans up data once its retention period has passed. All processing rests on the legal bases of PIPA + GDPR.
Personal data controller.
The personal data controller is Modfolio, the registered Korean business that operates Modfolio Connect. The Korean version of this policy is authoritative and names the representative and the chief privacy officer.
- Service name: Modfolio Connect
- Domains: login.modfolio.io, account.modfolio.io, connect.modfolio.io
- Contact channel: see §14
- Business name: Modfolio
- Business registration number (Korea): 637-65-00835
- Representative and chief privacy officer: named in the Korean version (/privacy) · contact connect@modfolio.io
What we collect.
The following table lists the categories and fields of data we collect and process. Every field maps to exactly one of four purposes: authentication, session, audit, or processing.
| Category | Specific fields |
|---|---|
| AccountACCOUNT | Email, display name, password hash, sign-up date |
| Authentication credentialsCREDENTIAL | TOTP secret hash, passkey public key (including metadata), backup code hash |
| SessionSESSION | Session token hash, device fingerprint summary, issued/expiry timestamps, IP address |
| OrganizationORG | Organization ID, role, permissions, tenant domain |
| Audit logAUDIT | Sign-in/sign-out, MFA attempts, permission changes, security events, IP, User-Agent |
| Processing (integration)DELEGATION | OIDC client ID, redirect URI matching, delegation chain (MCP agent), issued token metadata (jti, aud, scope) |
We do not store plaintext passwords. All passwords are processed with Better Auth standard hashing (Argon2 or bcrypt), and TOTP/passkey secrets are stored only as a hash or public key.
Why we collect.
- Authentication issuance — token issuance based on OIDC/OAuth 2.1 standards
- Session maintenance — active session verification and silent refresh
- Multi-factor authentication (MFA) — TOTP, passkey, backup code verification
- Security operations — threat detection, blocking abnormal logins, risk assessment
- Audit trail — regulatory response, incident investigation, accountability tracking
- Delegated identity — tracking and revoking the MCP agent delegation chain
- Legal obligation — retention obligations, responding to law-enforcement requests
Legal basis for processing.
We use PIPA §15·§17 and GDPR Art. 6(1) as the baseline. The legal basis for each processing purpose is as follows.
- Account issuance & session operation: performance of a contract (Art. 6(1)(b))
- Security logs & audit: legitimate interest (Art. 6(1)(f)) + legal obligation (Art. 6(1)(c))
- Marketing communications: explicit consent (Art. 6(1)(a))
- Statutory retention (E-Commerce Act, etc.): legal obligation (Art. 6(1)(c))
How long we keep it.
| Data type | Retention period |
|---|---|
| Active account data | Until account closureUser can delete directly |
| Audit log | Up to 13 monthsSecurity incident response + PIPA §29 |
| Session token | 30 days after expiry or revocationAccounting for DPoP/refresh handling |
| Payment & billing records | 5 yearsE-Commerce Act §6 |
| Marketing consent withdrawal records | 3 years after withdrawalDispute handling |
| Closed-account identifier (pseudonymized) | Indefinitely after anonymizationPrevent re-registration |
Data past its retention period is destroyed by an hourly automatic retention job. Destruction is immediate via SQL DELETE + R2 object delete, and backups are automatically purged after the 30-day PITR window.
List of processors.
The following processors handle data. Each processor's purpose and duration are restricted by a DPA (data processing agreement), and any use of data outside our control is prohibited.
- Cloudflare — Workers execution (request processing), the database connection path (encrypted Cloudflare Tunnel and Access), R2 object storage (including the daily database backup copy), KV cache, Queues. D1 keeps only the copy taken at the 2026-10-13 database switchover, for rollback, and it is deleted once the service has stabilised.
- Resend — transactional email delivery (password reset, MFA backup codes, security alerts). Email bodies are automatically destroyed after 30 days.
- SigNoz / OpenTelemetry collector — observability (traces, metrics, logs). Automatic PII redaction applied.
- athsra — operational secret storage (no access to user data)
Cross-border data transfer.
The primary copy of account, session and audit records is stored in a PostgreSQL database that Modfolio operates itself in the Republic of Korea. Requests are processed on the Cloudflare edge network, and the login and console Workers are placed near Seoul (ap-northeast-2), close to the database. The daily backup copy is kept in Cloudflare R2.
Notice of cross-border transfer under PIPA §28-2: where a processor's (§08) infrastructure is located overseas, we confirm that the country's data-protection level meets or exceeds the Korean standard (Cloudflare: ISO 27001, SOC 2, GDPR).
Your rights.
We guarantee the rights under PIPA §35–§37 and GDPR Art. 15–22.
- Right of access — download your data as JSON from the /profile > Data tab
- Right to rectification/erasure — edit your profile directly + delete your account in the Danger Zone
- Right to restrict processing — marketing consent withdrawal is applied immediately; for others, use the §14 channel
- Right to data portability — export in standard JSON format
- Right to object — you may request human review of automated decisions (risk engine)
Requests to exercise rights are processed within 30 business days. We may require additional authentication (email OTP or passkey) to verify your identity.
Technical and administrative security.
- In transit: TLS 1.3, HSTS enforced, DPoP token binding (RFC 9449)
- At rest: password hash, MFA secret hash, R2 ciphertext (athsra)
- Access control: RBAC + ReBAC, IP policy, conditional access (ACR rules)
- Continuous evaluation: Continuous Session Evaluation (RFC 9470), risk engine
- Real-time events: propagation of session revocation signals via SSF/CAEP (OpenID v1.0)
- Audit: all security events retained for 13 months, monitored in real time via observability
- Password policy: NIST SP 800-63B compliant (length-first, minimal composition rules)
Children's personal data.
Modfolio Connect does not provide services directly to children under the age of 14. If it is confirmed that a child registered without consent, we immediately deactivate the account and notify the guardian. Where a sibling app (education/campus service) targets children, that app separately performs the PIPA §22-2 procedure (guardian consent).
Version change history.
- v1.0 (2026-05-27) — KO baseline draft. Pending external legal review.
- v1.1 (2026-10-01) — Named the controller and chief privacy officer with the registered business details, and added an email channel. Pending external legal review.
Material changes (expanding collected fields, extending retention, adding a processor) are announced in advance by email or a sign-in screen banner 30 days before the effective date.
Personal data inquiries.
Inquiries, objections, and requests to exercise rights regarding personal data processing can be submitted through the following channels.
- Email (exercising rights, questions): connect@modfolio.io
- GitHub Security Advisory (exercising rights — private): github.com/modfolio/modfolio-connect/security/advisories/new
- General inquiries (matters that may be public): github.com/modfolio/modfolio-connect/issues
- Korea Personal Information Protection Commission dispute mediation: kopico.go.kr (118)