EEA, UK & Switzerland · GDPR
Privacy notice
for Europe.
Sets out the legal bases for processing and the rights available under the GDPR, the UK GDPR and Swiss data protection law. It prevails over the general policy for users in those regions.
Effective · 2026. 08. 06.
1. Scope and controller
This notice applies to users in the European Economic Area, the United Kingdom and Switzerland, and explains the additional rights available under the EU General Data Protection Regulation (GDPR), the UK GDPR and the Swiss Federal Act on Data Protection. It supplements the general privacy policy and prevails over it for users in those regions.
The controller is CommonSource, Seoul, Republic of Korea. Contact: contact@commonsourcelab.com.
2. Legal bases for processing (Article 6)
- Performance of a contract — Art. 6(1)(b)
- Delivering app and website functionality, confirming purchases and subscriptions, and performing the terms of service. Without this basis the service cannot be provided.
- Legitimate interests — Art. 6(1)(f)
- Keeping the service reliable, diagnosing errors, preventing misuse and security threats, and improving products using pseudonymized statistics. A balancing test is carried out to confirm these interests are not overridden by your rights and freedoms.
- Consent — Art. 6(1)(a)
- Using a generative-AI feature, and granting optional device permissions such as camera, photos, microphone, location or Bluetooth. Consent can be withdrawn at any time without affecting the lawfulness of processing before withdrawal.
- Legal obligation — Art. 6(1)(c)
- Meeting obligations that apply to the controller, such as tax and accounting record-keeping.
3. Data processed and its source
We process information you give us directly and information generated automatically as you use the service. We do not buy or otherwise acquire personal data from third parties.
- Provided by you
- Your email address and message when you contact us, and optionally the app name and device details.
- Generated automatically
- App version, device type, OS version, crash reports, access logs and pseudonymized usage statistics.
- Processed on your device
- Scanned documents, photos, learning history and vehicle diagnostics ordinarily never leave your device and are not accessible to the controller.
- Special categories (Article 9)
- We do not knowingly collect special-category data such as health, biometric or political information. Wellness data such as sleep logs is stored on the device only and is not transmitted to us.
4. Recipients and processors
The following act as processors under Article 28, each under a data processing agreement. We do not sell personal data or provide it for a third party’s own advertising purposes.
- Apple Inc.
- App distribution, payment and subscription processing, app analytics.
- Google LLC
- App distribution, payment and subscription processing, app analytics.
- Vercel Inc.
- Website hosting and performance measurement.
- Generative-AI providers
- Processing of submitted content, only when you actively use an AI feature.
5. International transfers (Articles 44–49)
The controller is established in the Republic of Korea and some processors are located outside the EEA, including in the United States. Personal data is therefore transferred outside the EEA and the UK.
The European Commission adopted an adequacy decision for the Republic of Korea in December 2021, and the UK has adequacy regulations covering Korea. Transfers to the controller rely on that adequacy.
Transfers to processors not covered by an adequacy decision rely on the European Commission’s Standard Contractual Clauses together with the UK International Data Transfer Addendum, supported where necessary by a transfer impact assessment and supplementary measures. A copy of the relevant documentation is available on request at contact@commonsourcelab.com.
6. Retention
- Support records
- Three years after the matter is closed, or immediately on your deletion request.
- Crash and error reports
- Up to twelve months from collection.
- Access logs
- Up to three months.
- Pseudonymized and anonymous statistics
- May be kept indefinitely because individuals can no longer be identified.
- Legal retention
- For the period required by applicable tax, accounting and similar law.
7. Your rights (Articles 15–22)
- Access — Art. 15
- Obtain a copy of your personal data and information about how it is processed.
- Rectification — Art. 16
- Have inaccurate or incomplete personal data corrected.
- Erasure — Art. 17
- The “right to be forgotten”, subject to exceptions such as a legal retention duty.
- Restriction — Art. 18
- Restrict processing in defined circumstances, for example while accuracy is contested.
- Portability — Art. 20
- Receive data processed by automated means on the basis of consent or contract in a structured, commonly used, machine-readable format.
- Objection — Art. 21
- Object at any time to processing based on legitimate interests. Objection to direct marketing is absolute.
- Automated decisions — Art. 22
- We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.
- Withdrawal of consent — Art. 7(3)
- Withdraw consent at any time where processing is based on it.
8. How to exercise your rights
Write to contact@commonsourcelab.com. We respond free of charge within one month of receipt. Where a request is complex or several requests are made, that period may be extended by up to two further months under Article 12(3); we will explain the reason within the first month.
If we cannot confirm your identity from the request, we may ask for the minimum additional information needed to verify it.
9. Complaints to a supervisory authority (Article 77)
You have the right to lodge a complaint with the supervisory authority of your habitual residence, place of work or the place of the alleged infringement. We would appreciate the chance to address your concern first at contact@commonsourcelab.com.
- EEA
- List of national supervisory authorities — edpb.europa.eu/about-edpb/board/members
- United Kingdom
- Information Commissioner’s Office (ICO) — ico.org.uk
- Switzerland
- Federal Data Protection and Information Commissioner (FDPIC) — edoeb.admin.ch
10. Children (Article 8)
Our services are not directed at children, and we do not knowingly rely on consent from a child below the age set by Article 8 (between 13 and 16 depending on the member state) for the provision of information society services.
If we learn that such data has been processed without the consent of a holder of parental responsibility, we delete it without delay.
11. Cookies and similar technologies
commonsourcelab.com does not use tracking or advertising cookies. We use a functional cookie to remember your chosen language and performance measurement that is aggregated so that it does not identify individuals.
We therefore do not deploy non-essential tracking technologies that would require consent under the ePrivacy Directive. If that changes, we will introduce a consent mechanism beforehand and update this notice.
12. Changes to this notice
We may update this notice when law, services or processing practices change. Material changes are announced on the website or in the relevant app before they take effect, and the effective date above is revised.
If you target users in the EEA on an ongoing basis, Article 27 may require you to designate an EU representative; once appointed, add their name and contact details to this notice. Have this document reviewed by a qualified lawyer before it takes effect.